SecurityPkg: remove PE/COFF header workaround for ELILO on IPF
[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / SecureBootConfigDxe / SecureBootConfigImpl.c
CommitLineData
beda2356 1/** @file\r
2 HII Config Access protocol implementation of SecureBoot configuration module.\r
3\r
b3548d32 4Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>\r
488aab25 5(C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>\r
bc0c99b3 6This program and the accompanying materials\r
7are licensed and made available under the terms and conditions of the BSD License\r
8which accompanies this distribution. The full text of the license may be found at\r
beda2356 9http://opensource.org/licenses/bsd-license.php\r
10\r
bc0c99b3 11THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
beda2356 12WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
13\r
14**/\r
15\r
16#include "SecureBootConfigImpl.h"\r
85974aef 17#include <Library/BaseCryptLib.h>\r
beda2356 18\r
ecc722ad 19CHAR16 mSecureBootStorageName[] = L"SECUREBOOT_CONFIGURATION";\r
beda2356 20\r
21SECUREBOOT_CONFIG_PRIVATE_DATA mSecureBootConfigPrivateDateTemplate = {\r
20333c6d 22 SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE,\r
beda2356 23 {\r
24 SecureBootExtractConfig,\r
25 SecureBootRouteConfig,\r
26 SecureBootCallback\r
27 }\r
28};\r
29\r
30HII_VENDOR_DEVICE_PATH mSecureBootHiiVendorDevicePath = {\r
31 {\r
32 {\r
33 HARDWARE_DEVICE_PATH,\r
34 HW_VENDOR_DP,\r
35 {\r
36 (UINT8) (sizeof (VENDOR_DEVICE_PATH)),\r
37 (UINT8) ((sizeof (VENDOR_DEVICE_PATH)) >> 8)\r
38 }\r
39 },\r
40 SECUREBOOT_CONFIG_FORM_SET_GUID\r
41 },\r
42 {\r
43 END_DEVICE_PATH_TYPE,\r
44 END_ENTIRE_DEVICE_PATH_SUBTYPE,\r
bc0c99b3 45 {\r
beda2356 46 (UINT8) (END_DEVICE_PATH_LENGTH),\r
47 (UINT8) ((END_DEVICE_PATH_LENGTH) >> 8)\r
48 }\r
49 }\r
50};\r
51\r
ecc722ad 52\r
a365eed4
FS
53BOOLEAN mIsEnterSecureBootForm = FALSE;\r
54\r
ecc722ad 55//\r
56// OID ASN.1 Value for Hash Algorithms\r
57//\r
58UINT8 mHashOidValue[] = {\r
59 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, // OBJ_md5\r
60 0x2B, 0x0E, 0x03, 0x02, 0x1A, // OBJ_sha1\r
61 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, // OBJ_sha224\r
62 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, // OBJ_sha256\r
63 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, // OBJ_sha384\r
64 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, // OBJ_sha512\r
65 };\r
66\r
67HASH_TABLE mHash[] = {\r
20333c6d
QL
68 { L"SHA224", 28, &mHashOidValue[13], 9, NULL, NULL, NULL, NULL },\r
69 { L"SHA256", 32, &mHashOidValue[22], 9, Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final},\r
70 { L"SHA384", 48, &mHashOidValue[31], 9, Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final},\r
71 { L"SHA512", 64, &mHashOidValue[40], 9, Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final}\r
ecc722ad 72};\r
73\r
e4d7370d 74//\r
20333c6d
QL
75// Variable Definitions\r
76//\r
ecc722ad 77UINT32 mPeCoffHeaderOffset = 0;\r
78WIN_CERTIFICATE *mCertificate = NULL;\r
79IMAGE_TYPE mImageType;\r
80UINT8 *mImageBase = NULL;\r
81UINTN mImageSize = 0;\r
82UINT8 mImageDigest[MAX_DIGEST_SIZE];\r
83UINTN mImageDigestSize;\r
84EFI_GUID mCertType;\r
85EFI_IMAGE_SECURITY_DATA_DIRECTORY *mSecDataDir = NULL;\r
86EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION mNtHeader;\r
87\r
e4d7370d 88//\r
89// Possible DER-encoded certificate file suffixes, end with NULL pointer.\r
90//\r
91CHAR16* mDerEncodedSuffix[] = {\r
92 L".cer",\r
93 L".der",\r
94 L".crt",\r
95 NULL\r
96};\r
97CHAR16* mSupportX509Suffix = L"*.cer/der/crt";\r
98\r
762d8ddb
DB
99SECUREBOOT_CONFIG_PRIVATE_DATA *gSecureBootPrivateData = NULL;\r
100\r
4de754e1
ZC
101/**\r
102 This code cleans up enrolled file by closing file & free related resources attached to\r
9d9b8b77 103 enrolled file.\r
4de754e1 104\r
9d9b8b77 105 @param[in] FileContext FileContext cached in SecureBootConfig driver\r
4de754e1
ZC
106\r
107**/\r
4de754e1
ZC
108VOID\r
109CloseEnrolledFile(\r
110 IN SECUREBOOT_FILE_CONTEXT *FileContext\r
111)\r
112{\r
113 if (FileContext->FHandle != NULL) {\r
114 CloseFile (FileContext->FHandle);\r
115 FileContext->FHandle = NULL;\r
116 }\r
117\r
118 if (FileContext->FileName != NULL){\r
119 FreePool(FileContext->FileName);\r
120 FileContext->FileName = NULL;\r
121 }\r
122 FileContext->FileType = UNKNOWN_FILE_TYPE;\r
123\r
124}\r
125\r
e4d7370d 126/**\r
127 This code checks if the FileSuffix is one of the possible DER-encoded certificate suffix.\r
128\r
129 @param[in] FileSuffix The suffix of the input certificate file\r
130\r
131 @retval TRUE It's a DER-encoded certificate.\r
132 @retval FALSE It's NOT a DER-encoded certificate.\r
133\r
134**/\r
135BOOLEAN\r
136IsDerEncodeCertificate (\r
137 IN CONST CHAR16 *FileSuffix\r
138)\r
139{\r
20333c6d 140 UINTN Index;\r
e4d7370d 141 for (Index = 0; mDerEncodedSuffix[Index] != NULL; Index++) {\r
142 if (StrCmp (FileSuffix, mDerEncodedSuffix[Index]) == 0) {\r
143 return TRUE;\r
144 }\r
145 }\r
146 return FALSE;\r
147}\r
ecc722ad 148\r
4de754e1
ZC
149/**\r
150 This code checks if the file content complies with EFI_VARIABLE_AUTHENTICATION_2 format\r
151The function reads file content but won't open/close given FileHandle.\r
152\r
153 @param[in] FileHandle The FileHandle to be checked\r
154\r
155 @retval TRUE The content is EFI_VARIABLE_AUTHENTICATION_2 format.\r
156 @retval FALSE The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.\r
157\r
158**/\r
159BOOLEAN\r
160IsAuthentication2Format (\r
161 IN EFI_FILE_HANDLE FileHandle\r
162)\r
163{\r
164 EFI_STATUS Status;\r
165 EFI_VARIABLE_AUTHENTICATION_2 *Auth2;\r
166 BOOLEAN IsAuth2Format;\r
167\r
168 IsAuth2Format = FALSE;\r
169\r
170 //\r
171 // Read the whole file content\r
172 //\r
173 Status = ReadFileContent(\r
174 FileHandle,\r
175 (VOID **) &mImageBase,\r
176 &mImageSize,\r
177 0\r
178 );\r
179 if (EFI_ERROR (Status)) {\r
180 goto ON_EXIT;\r
181 }\r
182\r
183 Auth2 = (EFI_VARIABLE_AUTHENTICATION_2 *)mImageBase;\r
184 if (Auth2->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {\r
185 goto ON_EXIT;\r
186 }\r
187\r
188 if (CompareGuid(&gEfiCertPkcs7Guid, &Auth2->AuthInfo.CertType)) {\r
189 IsAuth2Format = TRUE;\r
190 }\r
191\r
192ON_EXIT:\r
193 //\r
194 // Do not close File. simply check file content\r
195 //\r
196 if (mImageBase != NULL) {\r
197 FreePool (mImageBase);\r
198 mImageBase = NULL;\r
199 }\r
200\r
201 return IsAuth2Format;\r
202}\r
203\r
ecc722ad 204/**\r
205 Set Secure Boot option into variable space.\r
206\r
207 @param[in] VarValue The option of Secure Boot.\r
208\r
209 @retval EFI_SUCCESS The operation is finished successfully.\r
210 @retval Others Other errors as indicated.\r
211\r
212**/\r
213EFI_STATUS\r
214SaveSecureBootVariable (\r
215 IN UINT8 VarValue\r
216 )\r
217{\r
218 EFI_STATUS Status;\r
219\r
220 Status = gRT->SetVariable (\r
221 EFI_SECURE_BOOT_ENABLE_NAME,\r
222 &gEfiSecureBootEnableDisableGuid,\r
223 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
224 sizeof (UINT8),\r
225 &VarValue\r
226 );\r
227 return Status;\r
228}\r
229\r
8c1babfd 230/**\r
231 Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2\r
232 descriptor with the input data. NO authentication is required in this function.\r
20333c6d 233\r
8c1babfd 234 @param[in, out] DataSize On input, the size of Data buffer in bytes.\r
235 On output, the size of data returned in Data\r
236 buffer in bytes.\r
20333c6d 237 @param[in, out] Data On input, Pointer to data buffer to be wrapped or\r
8c1babfd 238 pointer to NULL to wrap an empty payload.\r
239 On output, Pointer to the new payload date buffer allocated from pool,\r
20333c6d 240 it's caller's responsibility to free the memory when finish using it.\r
8c1babfd 241\r
242 @retval EFI_SUCCESS Create time based payload successfully.\r
243 @retval EFI_OUT_OF_RESOURCES There are not enough memory resourses to create time based payload.\r
244 @retval EFI_INVALID_PARAMETER The parameter is invalid.\r
245 @retval Others Unexpected error happens.\r
246\r
247**/\r
248EFI_STATUS\r
249CreateTimeBasedPayload (\r
250 IN OUT UINTN *DataSize,\r
251 IN OUT UINT8 **Data\r
252 )\r
253{\r
254 EFI_STATUS Status;\r
255 UINT8 *NewData;\r
256 UINT8 *Payload;\r
257 UINTN PayloadSize;\r
258 EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;\r
259 UINTN DescriptorSize;\r
260 EFI_TIME Time;\r
20333c6d 261\r
8c1babfd 262 if (Data == NULL || DataSize == NULL) {\r
263 return EFI_INVALID_PARAMETER;\r
264 }\r
20333c6d 265\r
8c1babfd 266 //\r
20333c6d 267 // In Setup mode or Custom mode, the variable does not need to be signed but the\r
8c1babfd 268 // parameters to the SetVariable() call still need to be prepared as authenticated\r
269 // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor without certificate\r
270 // data in it.\r
271 //\r
272 Payload = *Data;\r
273 PayloadSize = *DataSize;\r
20333c6d 274\r
8c1babfd 275 DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);\r
276 NewData = (UINT8*) AllocateZeroPool (DescriptorSize + PayloadSize);\r
277 if (NewData == NULL) {\r
278 return EFI_OUT_OF_RESOURCES;\r
279 }\r
280\r
281 if ((Payload != NULL) && (PayloadSize != 0)) {\r
282 CopyMem (NewData + DescriptorSize, Payload, PayloadSize);\r
283 }\r
284\r
285 DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);\r
286\r
287 ZeroMem (&Time, sizeof (EFI_TIME));\r
288 Status = gRT->GetTime (&Time, NULL);\r
289 if (EFI_ERROR (Status)) {\r
290 FreePool(NewData);\r
291 return Status;\r
292 }\r
293 Time.Pad1 = 0;\r
294 Time.Nanosecond = 0;\r
295 Time.TimeZone = 0;\r
296 Time.Daylight = 0;\r
297 Time.Pad2 = 0;\r
298 CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));\r
20333c6d 299\r
8c1babfd 300 DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);\r
301 DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;\r
302 DescriptorData->AuthInfo.Hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;\r
303 CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);\r
20333c6d 304\r
8c1babfd 305 if (Payload != NULL) {\r
306 FreePool(Payload);\r
307 }\r
20333c6d 308\r
8c1babfd 309 *DataSize = DescriptorSize + PayloadSize;\r
310 *Data = NewData;\r
311 return EFI_SUCCESS;\r
312}\r
313\r
ecc722ad 314/**\r
315 Internal helper function to delete a Variable given its name and GUID, NO authentication\r
316 required.\r
317\r
318 @param[in] VariableName Name of the Variable.\r
319 @param[in] VendorGuid GUID of the Variable.\r
320\r
321 @retval EFI_SUCCESS Variable deleted successfully.\r
322 @retval Others The driver failed to start the device.\r
323\r
324**/\r
325EFI_STATUS\r
326DeleteVariable (\r
327 IN CHAR16 *VariableName,\r
328 IN EFI_GUID *VendorGuid\r
329 )\r
330{\r
331 EFI_STATUS Status;\r
332 VOID* Variable;\r
8c1babfd 333 UINT8 *Data;\r
334 UINTN DataSize;\r
335 UINT32 Attr;\r
ecc722ad 336\r
bf4a3dbd 337 GetVariable2 (VariableName, VendorGuid, &Variable, NULL);\r
ecc722ad 338 if (Variable == NULL) {\r
339 return EFI_SUCCESS;\r
340 }\r
f71ed839 341 FreePool (Variable);\r
ecc722ad 342\r
8c1babfd 343 Data = NULL;\r
344 DataSize = 0;\r
345 Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS\r
346 | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
ecc722ad 347\r
8c1babfd 348 Status = CreateTimeBasedPayload (&DataSize, &Data);\r
349 if (EFI_ERROR (Status)) {\r
350 DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
351 return Status;\r
ecc722ad 352 }\r
353\r
8c1babfd 354 Status = gRT->SetVariable (\r
355 VariableName,\r
356 VendorGuid,\r
357 Attr,\r
358 DataSize,\r
359 Data\r
360 );\r
361 if (Data != NULL) {\r
362 FreePool (Data);\r
ecc722ad 363 }\r
ecc722ad 364 return Status;\r
365}\r
366\r
f71ed839 367/**\r
368\r
369 Set the platform secure boot mode into "Custom" or "Standard" mode.\r
370\r
371 @param[in] SecureBootMode New secure boot mode: STANDARD_SECURE_BOOT_MODE or\r
372 CUSTOM_SECURE_BOOT_MODE.\r
20333c6d 373\r
f71ed839 374 @return EFI_SUCCESS The platform has switched to the special mode successfully.\r
375 @return other Fail to operate the secure boot mode.\r
20333c6d 376\r
f71ed839 377**/\r
378EFI_STATUS\r
379SetSecureBootMode (\r
380 IN UINT8 SecureBootMode\r
381 )\r
382{\r
20333c6d 383 return gRT->SetVariable (\r
f71ed839 384 EFI_CUSTOM_MODE_NAME,\r
385 &gEfiCustomModeEnableGuid,\r
386 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
387 sizeof (UINT8),\r
388 &SecureBootMode\r
389 );\r
390}\r
391\r
ecc722ad 392/**\r
393 Generate the PK signature list from the X509 Certificate storing file (.cer)\r
394\r
395 @param[in] X509File FileHandle of X509 Certificate storing file.\r
396 @param[out] PkCert Point to the data buffer to store the signature list.\r
20333c6d 397\r
ecc722ad 398 @return EFI_UNSUPPORTED Unsupported Key Length.\r
399 @return EFI_OUT_OF_RESOURCES There are not enough memory resourses to form the signature list.\r
20333c6d 400\r
ecc722ad 401**/\r
402EFI_STATUS\r
403CreatePkX509SignatureList (\r
20333c6d
QL
404 IN EFI_FILE_HANDLE X509File,\r
405 OUT EFI_SIGNATURE_LIST **PkCert\r
ecc722ad 406 )\r
407{\r
20333c6d 408 EFI_STATUS Status;\r
ecc722ad 409 UINT8 *X509Data;\r
410 UINTN X509DataSize;\r
411 EFI_SIGNATURE_DATA *PkCertData;\r
412\r
413 X509Data = NULL;\r
414 PkCertData = NULL;\r
20333c6d
QL
415 X509DataSize = 0;\r
416\r
4adc12bf 417 Status = ReadFileContent (X509File, (VOID**) &X509Data, &X509DataSize, 0);\r
ecc722ad 418 if (EFI_ERROR (Status)) {\r
419 goto ON_EXIT;\r
420 }\r
ba57d4fd 421 ASSERT (X509Data != NULL);\r
ecc722ad 422\r
423 //\r
424 // Allocate space for PK certificate list and initialize it.\r
425 // Create PK database entry with SignatureHeaderSize equals 0.\r
426 //\r
427 *PkCert = (EFI_SIGNATURE_LIST*) AllocateZeroPool (\r
428 sizeof(EFI_SIGNATURE_LIST) + sizeof(EFI_SIGNATURE_DATA) - 1\r
429 + X509DataSize\r
430 );\r
431 if (*PkCert == NULL) {\r
432 Status = EFI_OUT_OF_RESOURCES;\r
433 goto ON_EXIT;\r
434 }\r
435\r
20333c6d 436 (*PkCert)->SignatureListSize = (UINT32) (sizeof(EFI_SIGNATURE_LIST)\r
ecc722ad 437 + sizeof(EFI_SIGNATURE_DATA) - 1\r
438 + X509DataSize);\r
439 (*PkCert)->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);\r
440 (*PkCert)->SignatureHeaderSize = 0;\r
441 CopyGuid (&(*PkCert)->SignatureType, &gEfiCertX509Guid);\r
20333c6d 442 PkCertData = (EFI_SIGNATURE_DATA*) ((UINTN)(*PkCert)\r
ecc722ad 443 + sizeof(EFI_SIGNATURE_LIST)\r
444 + (*PkCert)->SignatureHeaderSize);\r
20333c6d 445 CopyGuid (&PkCertData->SignatureOwner, &gEfiGlobalVariableGuid);\r
ecc722ad 446 //\r
447 // Fill the PK database with PKpub data from X509 certificate file.\r
20333c6d 448 //\r
ecc722ad 449 CopyMem (&(PkCertData->SignatureData[0]), X509Data, X509DataSize);\r
20333c6d 450\r
ecc722ad 451ON_EXIT:\r
20333c6d 452\r
ecc722ad 453 if (X509Data != NULL) {\r
454 FreePool (X509Data);\r
455 }\r
20333c6d 456\r
ecc722ad 457 if (EFI_ERROR(Status) && *PkCert != NULL) {\r
458 FreePool (*PkCert);\r
459 *PkCert = NULL;\r
460 }\r
20333c6d 461\r
ecc722ad 462 return Status;\r
463}\r
464\r
465/**\r
466 Enroll new PK into the System without original PK's authentication.\r
467\r
468 The SignatureOwner GUID will be the same with PK's vendorguid.\r
469\r
470 @param[in] PrivateData The module's private data.\r
471\r
472 @retval EFI_SUCCESS New PK enrolled successfully.\r
473 @retval EFI_INVALID_PARAMETER The parameter is invalid.\r
474 @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.\r
20333c6d 475\r
ecc722ad 476**/\r
477EFI_STATUS\r
478EnrollPlatformKey (\r
479 IN SECUREBOOT_CONFIG_PRIVATE_DATA* Private\r
20333c6d 480 )\r
ecc722ad 481{\r
482 EFI_STATUS Status;\r
483 UINT32 Attr;\r
484 UINTN DataSize;\r
485 EFI_SIGNATURE_LIST *PkCert;\r
486 UINT16* FilePostFix;\r
fd64f84f 487 UINTN NameLength;\r
20333c6d 488\r
ecc722ad 489 if (Private->FileContext->FileName == NULL) {\r
490 return EFI_INVALID_PARAMETER;\r
491 }\r
492\r
493 PkCert = NULL;\r
494\r
f71ed839 495 Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
496 if (EFI_ERROR (Status)) {\r
497 return Status;\r
498 }\r
499\r
ecc722ad 500 //\r
e4d7370d 501 // Parse the file's postfix. Only support DER encoded X.509 certificate files.\r
ecc722ad 502 //\r
fd64f84f
GCPL
503 NameLength = StrLen (Private->FileContext->FileName);\r
504 if (NameLength <= 4) {\r
505 return EFI_INVALID_PARAMETER;\r
506 }\r
507 FilePostFix = Private->FileContext->FileName + NameLength - 4;\r
e4d7370d 508 if (!IsDerEncodeCertificate(FilePostFix)) {\r
509 DEBUG ((EFI_D_ERROR, "Unsupported file type, only DER encoded certificate (%s) is supported.", mSupportX509Suffix));\r
ecc722ad 510 return EFI_INVALID_PARAMETER;\r
511 }\r
512 DEBUG ((EFI_D_INFO, "FileName= %s\n", Private->FileContext->FileName));\r
513 DEBUG ((EFI_D_INFO, "FilePostFix = %s\n", FilePostFix));\r
514\r
515 //\r
516 // Prase the selected PK file and generature PK certificate list.\r
517 //\r
8c1babfd 518 Status = CreatePkX509SignatureList (\r
20333c6d
QL
519 Private->FileContext->FHandle,\r
520 &PkCert\r
8c1babfd 521 );\r
522 if (EFI_ERROR (Status)) {\r
523 goto ON_EXIT;\r
ecc722ad 524 }\r
ba57d4fd 525 ASSERT (PkCert != NULL);\r
20333c6d 526\r
ecc722ad 527 //\r
528 // Set Platform Key variable.\r
20333c6d
QL
529 //\r
530 Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r
8c1babfd 531 | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
ecc722ad 532 DataSize = PkCert->SignatureListSize;\r
8c1babfd 533 Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &PkCert);\r
534 if (EFI_ERROR (Status)) {\r
535 DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
536 goto ON_EXIT;\r
537 }\r
20333c6d 538\r
ecc722ad 539 Status = gRT->SetVariable(\r
20333c6d
QL
540 EFI_PLATFORM_KEY_NAME,\r
541 &gEfiGlobalVariableGuid,\r
542 Attr,\r
543 DataSize,\r
ecc722ad 544 PkCert\r
545 );\r
546 if (EFI_ERROR (Status)) {\r
547 if (Status == EFI_OUT_OF_RESOURCES) {\r
548 DEBUG ((EFI_D_ERROR, "Enroll PK failed with out of resource.\n"));\r
549 }\r
550 goto ON_EXIT;\r
551 }\r
20333c6d 552\r
ecc722ad 553ON_EXIT:\r
554\r
555 if (PkCert != NULL) {\r
556 FreePool(PkCert);\r
557 }\r
20333c6d 558\r
4de754e1 559 CloseEnrolledFile(Private->FileContext);\r
ecc722ad 560\r
561 return Status;\r
562}\r
563\r
564/**\r
565 Remove the PK variable.\r
566\r
567 @retval EFI_SUCCESS Delete PK successfully.\r
568 @retval Others Could not allow to delete PK.\r
20333c6d 569\r
ecc722ad 570**/\r
571EFI_STATUS\r
572DeletePlatformKey (\r
573 VOID\r
574)\r
575{\r
576 EFI_STATUS Status;\r
577\r
f71ed839 578 Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
579 if (EFI_ERROR (Status)) {\r
580 return Status;\r
581 }\r
582\r
8c1babfd 583 Status = DeleteVariable (\r
584 EFI_PLATFORM_KEY_NAME,\r
585 &gEfiGlobalVariableGuid\r
586 );\r
ecc722ad 587 return Status;\r
588}\r
589\r
590/**\r
591 Enroll a new KEK item from public key storing file (*.pbk).\r
592\r
593 @param[in] PrivateData The module's private data.\r
594\r
595 @retval EFI_SUCCESS New KEK enrolled successfully.\r
596 @retval EFI_INVALID_PARAMETER The parameter is invalid.\r
597 @retval EFI_UNSUPPORTED Unsupported command.\r
598 @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.\r
599\r
600**/\r
601EFI_STATUS\r
602EnrollRsa2048ToKek (\r
603 IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private\r
604 )\r
605{\r
606 EFI_STATUS Status;\r
607 UINT32 Attr;\r
608 UINTN DataSize;\r
609 EFI_SIGNATURE_LIST *KekSigList;\r
610 UINTN KeyBlobSize;\r
611 UINT8 *KeyBlob;\r
612 CPL_KEY_INFO *KeyInfo;\r
613 EFI_SIGNATURE_DATA *KEKSigData;\r
614 UINTN KekSigListSize;\r
20333c6d 615 UINT8 *KeyBuffer;\r
ecc722ad 616 UINTN KeyLenInBytes;\r
617\r
618 Attr = 0;\r
619 DataSize = 0;\r
620 KeyBuffer = NULL;\r
621 KeyBlobSize = 0;\r
622 KeyBlob = NULL;\r
623 KeyInfo = NULL;\r
624 KEKSigData = NULL;\r
625 KekSigList = NULL;\r
626 KekSigListSize = 0;\r
20333c6d 627\r
ecc722ad 628 //\r
629 // Form the KeKpub certificate list into EFI_SIGNATURE_LIST type.\r
630 // First, We have to parse out public key data from the pbk key file.\r
20333c6d 631 //\r
ecc722ad 632 Status = ReadFileContent (\r
633 Private->FileContext->FHandle,\r
4adc12bf 634 (VOID**) &KeyBlob,\r
ecc722ad 635 &KeyBlobSize,\r
636 0\r
637 );\r
638 if (EFI_ERROR (Status)) {\r
639 goto ON_EXIT;\r
640 }\r
ba57d4fd 641 ASSERT (KeyBlob != NULL);\r
ecc722ad 642 KeyInfo = (CPL_KEY_INFO *) KeyBlob;\r
643 if (KeyInfo->KeyLengthInBits / 8 != WIN_CERT_UEFI_RSA2048_SIZE) {\r
644 DEBUG ((DEBUG_ERROR, "Unsupported key length, Only RSA2048 is supported.\n"));\r
645 Status = EFI_UNSUPPORTED;\r
646 goto ON_EXIT;\r
647 }\r
20333c6d 648\r
ecc722ad 649 //\r
650 // Convert the Public key to fix octet string format represented in RSA PKCS#1.\r
20333c6d 651 //\r
ecc722ad 652 KeyLenInBytes = KeyInfo->KeyLengthInBits / 8;\r
653 KeyBuffer = AllocateZeroPool (KeyLenInBytes);\r
654 if (KeyBuffer == NULL) {\r
655 Status = EFI_OUT_OF_RESOURCES;\r
656 goto ON_EXIT;\r
657 }\r
658 Int2OctStr (\r
20333c6d
QL
659 (UINTN*) (KeyBlob + sizeof (CPL_KEY_INFO)),\r
660 KeyLenInBytes / sizeof (UINTN),\r
661 KeyBuffer,\r
ecc722ad 662 KeyLenInBytes\r
663 );\r
664 CopyMem(KeyBlob + sizeof(CPL_KEY_INFO), KeyBuffer, KeyLenInBytes);\r
20333c6d 665\r
ecc722ad 666 //\r
667 // Form an new EFI_SIGNATURE_LIST.\r
668 //\r
669 KekSigListSize = sizeof(EFI_SIGNATURE_LIST)\r
670 + sizeof(EFI_SIGNATURE_DATA) - 1\r
671 + WIN_CERT_UEFI_RSA2048_SIZE;\r
672\r
673 KekSigList = (EFI_SIGNATURE_LIST*) AllocateZeroPool (KekSigListSize);\r
674 if (KekSigList == NULL) {\r
675 Status = EFI_OUT_OF_RESOURCES;\r
676 goto ON_EXIT;\r
677 }\r
678\r
679 KekSigList->SignatureListSize = sizeof(EFI_SIGNATURE_LIST)\r
680 + sizeof(EFI_SIGNATURE_DATA) - 1\r
681 + WIN_CERT_UEFI_RSA2048_SIZE;\r
682 KekSigList->SignatureHeaderSize = 0;\r
683 KekSigList->SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + WIN_CERT_UEFI_RSA2048_SIZE;\r
684 CopyGuid (&KekSigList->SignatureType, &gEfiCertRsa2048Guid);\r
20333c6d 685\r
ecc722ad 686 KEKSigData = (EFI_SIGNATURE_DATA*)((UINT8*)KekSigList + sizeof(EFI_SIGNATURE_LIST));\r
687 CopyGuid (&KEKSigData->SignatureOwner, Private->SignatureGUID);\r
688 CopyMem (\r
689 KEKSigData->SignatureData,\r
690 KeyBlob + sizeof(CPL_KEY_INFO),\r
691 WIN_CERT_UEFI_RSA2048_SIZE\r
692 );\r
20333c6d 693\r
ecc722ad 694 //\r
20333c6d
QL
695 // Check if KEK entry has been already existed.\r
696 // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the\r
ecc722ad 697 // new KEK to original variable.\r
20333c6d
QL
698 //\r
699 Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r
8c1babfd 700 | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
701 Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);\r
702 if (EFI_ERROR (Status)) {\r
703 DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
704 goto ON_EXIT;\r
705 }\r
706\r
ecc722ad 707 Status = gRT->GetVariable(\r
20333c6d
QL
708 EFI_KEY_EXCHANGE_KEY_NAME,\r
709 &gEfiGlobalVariableGuid,\r
710 NULL,\r
711 &DataSize,\r
ecc722ad 712 NULL\r
713 );\r
714 if (Status == EFI_BUFFER_TOO_SMALL) {\r
715 Attr |= EFI_VARIABLE_APPEND_WRITE;\r
716 } else if (Status != EFI_NOT_FOUND) {\r
717 goto ON_EXIT;\r
718 }\r
20333c6d 719\r
ecc722ad 720 //\r
721 // Done. Now we have formed the correct KEKpub database item, just set it into variable storage,\r
20333c6d 722 //\r
ecc722ad 723 Status = gRT->SetVariable(\r
20333c6d
QL
724 EFI_KEY_EXCHANGE_KEY_NAME,\r
725 &gEfiGlobalVariableGuid,\r
726 Attr,\r
727 KekSigListSize,\r
ecc722ad 728 KekSigList\r
729 );\r
730 if (EFI_ERROR (Status)) {\r
731 goto ON_EXIT;\r
732 }\r
20333c6d 733\r
ecc722ad 734ON_EXIT:\r
735\r
4de754e1 736 CloseEnrolledFile(Private->FileContext);\r
ecc722ad 737\r
738 if (Private->SignatureGUID != NULL) {\r
739 FreePool (Private->SignatureGUID);\r
740 Private->SignatureGUID = NULL;\r
741 }\r
742\r
743 if (KeyBlob != NULL) {\r
744 FreePool (KeyBlob);\r
745 }\r
746 if (KeyBuffer != NULL) {\r
747 FreePool (KeyBuffer);\r
748 }\r
749 if (KekSigList != NULL) {\r
750 FreePool (KekSigList);\r
751 }\r
20333c6d 752\r
ecc722ad 753 return Status;\r
754}\r
755\r
756/**\r
757 Enroll a new KEK item from X509 certificate file.\r
758\r
759 @param[in] PrivateData The module's private data.\r
760\r
761 @retval EFI_SUCCESS New X509 is enrolled successfully.\r
762 @retval EFI_INVALID_PARAMETER The parameter is invalid.\r
763 @retval EFI_UNSUPPORTED Unsupported command.\r
764 @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.\r
765\r
766**/\r
767EFI_STATUS\r
768EnrollX509ToKek (\r
769 IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private\r
20333c6d 770 )\r
ecc722ad 771{\r
772 EFI_STATUS Status;\r
773 UINTN X509DataSize;\r
774 VOID *X509Data;\r
775 EFI_SIGNATURE_DATA *KEKSigData;\r
776 EFI_SIGNATURE_LIST *KekSigList;\r
777 UINTN DataSize;\r
778 UINTN KekSigListSize;\r
779 UINT32 Attr;\r
780\r
781 X509Data = NULL;\r
782 X509DataSize = 0;\r
783 KekSigList = NULL;\r
784 KekSigListSize = 0;\r
785 DataSize = 0;\r
786 KEKSigData = NULL;\r
787\r
788 Status = ReadFileContent (\r
789 Private->FileContext->FHandle,\r
790 &X509Data,\r
791 &X509DataSize,\r
792 0\r
793 );\r
794 if (EFI_ERROR (Status)) {\r
795 goto ON_EXIT;\r
796 }\r
ba57d4fd 797 ASSERT (X509Data != NULL);\r
ecc722ad 798\r
799 KekSigListSize = sizeof(EFI_SIGNATURE_LIST) + sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize;\r
800 KekSigList = (EFI_SIGNATURE_LIST*) AllocateZeroPool (KekSigListSize);\r
801 if (KekSigList == NULL) {\r
802 Status = EFI_OUT_OF_RESOURCES;\r
803 goto ON_EXIT;\r
804 }\r
805\r
806 //\r
807 // Fill Certificate Database parameters.\r
20333c6d 808 //\r
ecc722ad 809 KekSigList->SignatureListSize = (UINT32) KekSigListSize;\r
810 KekSigList->SignatureHeaderSize = 0;\r
811 KekSigList->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);\r
812 CopyGuid (&KekSigList->SignatureType, &gEfiCertX509Guid);\r
813\r
814 KEKSigData = (EFI_SIGNATURE_DATA*) ((UINT8*) KekSigList + sizeof (EFI_SIGNATURE_LIST));\r
815 CopyGuid (&KEKSigData->SignatureOwner, Private->SignatureGUID);\r
816 CopyMem (KEKSigData->SignatureData, X509Data, X509DataSize);\r
817\r
818 //\r
20333c6d
QL
819 // Check if KEK been already existed.\r
820 // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the\r
ecc722ad 821 // new kek to original variable\r
20333c6d
QL
822 //\r
823 Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r
8c1babfd 824 | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
825 Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);\r
826 if (EFI_ERROR (Status)) {\r
827 DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
828 goto ON_EXIT;\r
829 }\r
20333c6d 830\r
ecc722ad 831 Status = gRT->GetVariable(\r
20333c6d
QL
832 EFI_KEY_EXCHANGE_KEY_NAME,\r
833 &gEfiGlobalVariableGuid,\r
834 NULL,\r
835 &DataSize,\r
ecc722ad 836 NULL\r
837 );\r
838 if (Status == EFI_BUFFER_TOO_SMALL) {\r
839 Attr |= EFI_VARIABLE_APPEND_WRITE;\r
840 } else if (Status != EFI_NOT_FOUND) {\r
841 goto ON_EXIT;\r
20333c6d 842 }\r
ecc722ad 843\r
844 Status = gRT->SetVariable(\r
20333c6d
QL
845 EFI_KEY_EXCHANGE_KEY_NAME,\r
846 &gEfiGlobalVariableGuid,\r
847 Attr,\r
ecc722ad 848 KekSigListSize,\r
849 KekSigList\r
850 );\r
851 if (EFI_ERROR (Status)) {\r
852 goto ON_EXIT;\r
853 }\r
854\r
855ON_EXIT:\r
20333c6d 856\r
4de754e1 857 CloseEnrolledFile(Private->FileContext);\r
20333c6d
QL
858\r
859 if (Private->SignatureGUID != NULL) {\r
860 FreePool (Private->SignatureGUID);\r
861 Private->SignatureGUID = NULL;\r
862 }\r
863\r
864 if (KekSigList != NULL) {\r
865 FreePool (KekSigList);\r
866 }\r
867\r
868 return Status;\r
869}\r
870\r
871/**\r
872 Enroll new KEK into the System without PK's authentication.\r
873 The SignatureOwner GUID will be Private->SignatureGUID.\r
874\r
875 @param[in] PrivateData The module's private data.\r
876\r
877 @retval EFI_SUCCESS New KEK enrolled successful.\r
878 @retval EFI_INVALID_PARAMETER The parameter is invalid.\r
879 @retval others Fail to enroll KEK data.\r
880\r
881**/\r
882EFI_STATUS\r
883EnrollKeyExchangeKey (\r
884 IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private\r
885 )\r
886{\r
887 UINT16* FilePostFix;\r
888 EFI_STATUS Status;\r
889 UINTN NameLength;\r
890\r
4de754e1 891 if ((Private->FileContext->FHandle == NULL) || (Private->FileContext->FileName == NULL) || (Private->SignatureGUID == NULL)) {\r
20333c6d
QL
892 return EFI_INVALID_PARAMETER;\r
893 }\r
894\r
895 Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
896 if (EFI_ERROR (Status)) {\r
897 return Status;\r
898 }\r
899\r
900 //\r
901 // Parse the file's postfix. Supports DER-encoded X509 certificate,\r
902 // and .pbk as RSA public key file.\r
903 //\r
904 NameLength = StrLen (Private->FileContext->FileName);\r
905 if (NameLength <= 4) {\r
906 return EFI_INVALID_PARAMETER;\r
907 }\r
908 FilePostFix = Private->FileContext->FileName + NameLength - 4;\r
909 if (IsDerEncodeCertificate(FilePostFix)) {\r
910 return EnrollX509ToKek (Private);\r
911 } else if (CompareMem (FilePostFix, L".pbk",4) == 0) {\r
912 return EnrollRsa2048ToKek (Private);\r
913 } else {\r
4de754e1
ZC
914 //\r
915 // File type is wrong, simply close it\r
916 //\r
917 CloseEnrolledFile(Private->FileContext);\r
918\r
20333c6d
QL
919 return EFI_INVALID_PARAMETER;\r
920 }\r
921}\r
922\r
923/**\r
924 Enroll a new X509 certificate into Signature Database (DB or DBX or DBT) without\r
925 KEK's authentication.\r
926\r
927 @param[in] PrivateData The module's private data.\r
928 @param[in] VariableName Variable name of signature database, must be\r
929 EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.\r
930\r
931 @retval EFI_SUCCESS New X509 is enrolled successfully.\r
932 @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.\r
933\r
934**/\r
935EFI_STATUS\r
936EnrollX509toSigDB (\r
937 IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,\r
938 IN CHAR16 *VariableName\r
939 )\r
940{\r
941 EFI_STATUS Status;\r
942 UINTN X509DataSize;\r
943 VOID *X509Data;\r
944 EFI_SIGNATURE_LIST *SigDBCert;\r
945 EFI_SIGNATURE_DATA *SigDBCertData;\r
946 VOID *Data;\r
947 UINTN DataSize;\r
948 UINTN SigDBSize;\r
949 UINT32 Attr;\r
950\r
951 X509DataSize = 0;\r
952 SigDBSize = 0;\r
953 DataSize = 0;\r
954 X509Data = NULL;\r
955 SigDBCert = NULL;\r
956 SigDBCertData = NULL;\r
957 Data = NULL;\r
958\r
959 Status = ReadFileContent (\r
960 Private->FileContext->FHandle,\r
961 &X509Data,\r
962 &X509DataSize,\r
963 0\r
964 );\r
965 if (EFI_ERROR (Status)) {\r
966 goto ON_EXIT;\r
967 }\r
968 ASSERT (X509Data != NULL);\r
969\r
970 SigDBSize = sizeof(EFI_SIGNATURE_LIST) + sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize;\r
971\r
972 Data = AllocateZeroPool (SigDBSize);\r
973 if (Data == NULL) {\r
974 Status = EFI_OUT_OF_RESOURCES;\r
975 goto ON_EXIT;\r
976 }\r
977\r
978 //\r
979 // Fill Certificate Database parameters.\r
980 //\r
981 SigDBCert = (EFI_SIGNATURE_LIST*) Data;\r
982 SigDBCert->SignatureListSize = (UINT32) SigDBSize;\r
983 SigDBCert->SignatureHeaderSize = 0;\r
984 SigDBCert->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);\r
985 CopyGuid (&SigDBCert->SignatureType, &gEfiCertX509Guid);\r
986\r
987 SigDBCertData = (EFI_SIGNATURE_DATA*) ((UINT8* ) SigDBCert + sizeof (EFI_SIGNATURE_LIST));\r
988 CopyGuid (&SigDBCertData->SignatureOwner, Private->SignatureGUID);\r
989 CopyMem ((UINT8* ) (SigDBCertData->SignatureData), X509Data, X509DataSize);\r
990\r
991 //\r
992 // Check if signature database entry has been already existed.\r
993 // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the\r
994 // new signature data to original variable\r
995 //\r
996 Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r
997 | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
998 Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);\r
999 if (EFI_ERROR (Status)) {\r
1000 DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
1001 goto ON_EXIT;\r
1002 }\r
1003\r
1004 Status = gRT->GetVariable(\r
1005 VariableName,\r
1006 &gEfiImageSecurityDatabaseGuid,\r
1007 NULL,\r
1008 &DataSize,\r
1009 NULL\r
1010 );\r
1011 if (Status == EFI_BUFFER_TOO_SMALL) {\r
1012 Attr |= EFI_VARIABLE_APPEND_WRITE;\r
1013 } else if (Status != EFI_NOT_FOUND) {\r
1014 goto ON_EXIT;\r
1015 }\r
1016\r
1017 Status = gRT->SetVariable(\r
1018 VariableName,\r
1019 &gEfiImageSecurityDatabaseGuid,\r
1020 Attr,\r
1021 SigDBSize,\r
1022 Data\r
1023 );\r
1024 if (EFI_ERROR (Status)) {\r
1025 goto ON_EXIT;\r
1026 }\r
1027\r
1028ON_EXIT:\r
1029\r
4de754e1 1030 CloseEnrolledFile(Private->FileContext);\r
20333c6d
QL
1031\r
1032 if (Private->SignatureGUID != NULL) {\r
1033 FreePool (Private->SignatureGUID);\r
1034 Private->SignatureGUID = NULL;\r
1035 }\r
1036\r
1037 if (Data != NULL) {\r
1038 FreePool (Data);\r
1039 }\r
1040\r
1041 if (X509Data != NULL) {\r
1042 FreePool (X509Data);\r
1043 }\r
1044\r
1045 return Status;\r
1046}\r
1047\r
1048/**\r
1049 Check whether signature is in specified database.\r
1050\r
1051 @param[in] VariableName Name of database variable that is searched in.\r
1052 @param[in] Signature Pointer to signature that is searched for.\r
1053 @param[in] SignatureSize Size of Signature.\r
1054\r
1055 @return TRUE Found the signature in the variable database.\r
1056 @return FALSE Not found the signature in the variable database.\r
1057\r
1058**/\r
1059BOOLEAN\r
1060IsSignatureFoundInDatabase (\r
1061 IN CHAR16 *VariableName,\r
1062 IN UINT8 *Signature,\r
1063 IN UINTN SignatureSize\r
1064 )\r
1065{\r
1066 EFI_STATUS Status;\r
1067 EFI_SIGNATURE_LIST *CertList;\r
1068 EFI_SIGNATURE_DATA *Cert;\r
1069 UINTN DataSize;\r
1070 UINT8 *Data;\r
1071 UINTN Index;\r
1072 UINTN CertCount;\r
1073 BOOLEAN IsFound;\r
1074\r
1075 //\r
1076 // Read signature database variable.\r
1077 //\r
1078 IsFound = FALSE;\r
1079 Data = NULL;\r
1080 DataSize = 0;\r
1081 Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
1082 if (Status != EFI_BUFFER_TOO_SMALL) {\r
1083 return FALSE;\r
1084 }\r
1085\r
1086 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
1087 if (Data == NULL) {\r
1088 return FALSE;\r
1089 }\r
1090\r
1091 Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);\r
1092 if (EFI_ERROR (Status)) {\r
1093 goto Done;\r
1094 }\r
1095\r
1096 //\r
1097 // Enumerate all signature data in SigDB to check if executable's signature exists.\r
1098 //\r
1099 CertList = (EFI_SIGNATURE_LIST *) Data;\r
1100 while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {\r
1101 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
1102 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
1103 if ((CertList->SignatureSize == sizeof(EFI_SIGNATURE_DATA) - 1 + SignatureSize) && (CompareGuid(&CertList->SignatureType, &gEfiCertX509Guid))) {\r
1104 for (Index = 0; Index < CertCount; Index++) {\r
1105 if (CompareMem (Cert->SignatureData, Signature, SignatureSize) == 0) {\r
1106 //\r
1107 // Find the signature in database.\r
1108 //\r
1109 IsFound = TRUE;\r
1110 break;\r
1111 }\r
1112 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
1113 }\r
1114\r
1115 if (IsFound) {\r
1116 break;\r
1117 }\r
1118 }\r
1119\r
1120 DataSize -= CertList->SignatureListSize;\r
1121 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
1122 }\r
1123\r
1124Done:\r
1125 if (Data != NULL) {\r
1126 FreePool (Data);\r
1127 }\r
1128\r
1129 return IsFound;\r
1130}\r
1131\r
1132/**\r
1133 Calculate the hash of a certificate data with the specified hash algorithm.\r
1134\r
1135 @param[in] CertData The certificate data to be hashed.\r
1136 @param[in] CertSize The certificate size in bytes.\r
1137 @param[in] HashAlg The specified hash algorithm.\r
1138 @param[out] CertHash The output digest of the certificate\r
1139\r
1140 @retval TRUE Successfully got the hash of the CertData.\r
1141 @retval FALSE Failed to get the hash of CertData.\r
1142\r
1143**/\r
1144BOOLEAN\r
1145CalculateCertHash (\r
1146 IN UINT8 *CertData,\r
1147 IN UINTN CertSize,\r
1148 IN UINT32 HashAlg,\r
1149 OUT UINT8 *CertHash\r
1150 )\r
1151{\r
1152 BOOLEAN Status;\r
1153 VOID *HashCtx;\r
1154 UINTN CtxSize;\r
12d95665
LQ
1155 UINT8 *TBSCert;\r
1156 UINTN TBSCertSize;\r
20333c6d
QL
1157\r
1158 HashCtx = NULL;\r
1159 Status = FALSE;\r
1160\r
1161 if (HashAlg >= HASHALG_MAX) {\r
1162 return FALSE;\r
1163 }\r
1164\r
12d95665
LQ
1165 //\r
1166 // Retrieve the TBSCertificate for Hash Calculation.\r
1167 //\r
1168 if (!X509GetTBSCert (CertData, CertSize, &TBSCert, &TBSCertSize)) {\r
1169 return FALSE;\r
1170 }\r
1171\r
20333c6d
QL
1172 //\r
1173 // 1. Initialize context of hash.\r
1174 //\r
1175 CtxSize = mHash[HashAlg].GetContextSize ();\r
1176 HashCtx = AllocatePool (CtxSize);\r
1177 ASSERT (HashCtx != NULL);\r
1178\r
1179 //\r
1180 // 2. Initialize a hash context.\r
1181 //\r
1182 Status = mHash[HashAlg].HashInit (HashCtx);\r
1183 if (!Status) {\r
1184 goto Done;\r
1185 }\r
1186\r
1187 //\r
1188 // 3. Calculate the hash.\r
1189 //\r
12d95665 1190 Status = mHash[HashAlg].HashUpdate (HashCtx, TBSCert, TBSCertSize);\r
20333c6d
QL
1191 if (!Status) {\r
1192 goto Done;\r
1193 }\r
1194\r
1195 //\r
1196 // 4. Get the hash result.\r
1197 //\r
1198 ZeroMem (CertHash, mHash[HashAlg].DigestLength);\r
1199 Status = mHash[HashAlg].HashFinal (HashCtx, CertHash);\r
1200\r
1201Done:\r
1202 if (HashCtx != NULL) {\r
1203 FreePool (HashCtx);\r
1204 }\r
1205\r
1206 return Status;\r
1207}\r
1208\r
1209/**\r
1210 Check whether the hash of an X.509 certificate is in forbidden database (DBX).\r
1211\r
1212 @param[in] Certificate Pointer to X.509 Certificate that is searched for.\r
1213 @param[in] CertSize Size of X.509 Certificate.\r
1214\r
1215 @return TRUE Found the certificate hash in the forbidden database.\r
1216 @return FALSE Certificate hash is Not found in the forbidden database.\r
1217\r
1218**/\r
1219BOOLEAN\r
1220IsCertHashFoundInDbx (\r
1221 IN UINT8 *Certificate,\r
1222 IN UINTN CertSize\r
1223 )\r
1224{\r
1225 BOOLEAN IsFound;\r
1226 EFI_STATUS Status;\r
1227 EFI_SIGNATURE_LIST *DbxList;\r
1228 EFI_SIGNATURE_DATA *CertHash;\r
1229 UINTN CertHashCount;\r
1230 UINTN Index;\r
1231 UINT32 HashAlg;\r
1232 UINT8 CertDigest[MAX_DIGEST_SIZE];\r
1233 UINT8 *DbxCertHash;\r
1234 UINTN SiglistHeaderSize;\r
1235 UINT8 *Data;\r
1236 UINTN DataSize;\r
1237\r
1238 IsFound = FALSE;\r
1239 HashAlg = HASHALG_MAX;\r
1240 Data = NULL;\r
1241\r
1242 //\r
1243 // Read signature database variable.\r
1244 //\r
1245 DataSize = 0;\r
1246 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
1247 if (Status != EFI_BUFFER_TOO_SMALL) {\r
1248 return FALSE;\r
1249 }\r
1250\r
1251 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
1252 if (Data == NULL) {\r
1253 return FALSE;\r
1254 }\r
1255\r
1256 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);\r
1257 if (EFI_ERROR (Status)) {\r
1258 goto Done;\r
1259 }\r
1260\r
1261 //\r
1262 // Check whether the certificate hash exists in the forbidden database.\r
1263 //\r
1264 DbxList = (EFI_SIGNATURE_LIST *) Data;\r
1265 while ((DataSize > 0) && (DataSize >= DbxList->SignatureListSize)) {\r
1266 //\r
1267 // Determine Hash Algorithm of Certificate in the forbidden database.\r
1268 //\r
1269 if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha256Guid)) {\r
1270 HashAlg = HASHALG_SHA256;\r
1271 } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha384Guid)) {\r
1272 HashAlg = HASHALG_SHA384;\r
1273 } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha512Guid)) {\r
1274 HashAlg = HASHALG_SHA512;\r
1275 } else {\r
1276 DataSize -= DbxList->SignatureListSize;\r
1277 DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);\r
1278 continue;\r
1279 }\r
1280\r
1281 //\r
1282 // Calculate the hash value of current db certificate for comparision.\r
1283 //\r
1284 if (!CalculateCertHash (Certificate, CertSize, HashAlg, CertDigest)) {\r
1285 goto Done;\r
1286 }\r
1287\r
1288 SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;\r
1289 CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);\r
1290 CertHashCount = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;\r
1291 for (Index = 0; Index < CertHashCount; Index++) {\r
1292 //\r
1293 // Iterate each Signature Data Node within this CertList for verify.\r
1294 //\r
1295 DbxCertHash = CertHash->SignatureData;\r
1296 if (CompareMem (DbxCertHash, CertDigest, mHash[HashAlg].DigestLength) == 0) {\r
1297 //\r
1298 // Hash of Certificate is found in forbidden database.\r
1299 //\r
1300 IsFound = TRUE;\r
1301 goto Done;\r
1302 }\r
1303 CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertHash + DbxList->SignatureSize);\r
1304 }\r
1305\r
1306 DataSize -= DbxList->SignatureListSize;\r
1307 DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);\r
1308 }\r
1309\r
1310Done:\r
1311 if (Data != NULL) {\r
1312 FreePool (Data);\r
1313 }\r
1314\r
1315 return IsFound;\r
1316}\r
1317\r
1318/**\r
1319 Check whether the signature list exists in given variable data.\r
1320\r
1321 It searches the signature list for the ceritificate hash by CertType.\r
1322 If the signature list is found, get the offset of Database for the\r
1323 next hash of a certificate.\r
1324\r
1325 @param[in] Database Variable data to save signature list.\r
1326 @param[in] DatabaseSize Variable size.\r
1327 @param[in] SignatureType The type of the signature.\r
1328 @param[out] Offset The offset to save a new hash of certificate.\r
1329\r
1330 @return TRUE The signature list is found in the forbidden database.\r
1331 @return FALSE The signature list is not found in the forbidden database.\r
1332**/\r
1333BOOLEAN\r
1334GetSignaturelistOffset (\r
1335 IN EFI_SIGNATURE_LIST *Database,\r
1336 IN UINTN DatabaseSize,\r
1337 IN EFI_GUID *SignatureType,\r
1338 OUT UINTN *Offset\r
1339 )\r
1340{\r
1341 EFI_SIGNATURE_LIST *SigList;\r
1342 UINTN SiglistSize;\r
1343\r
1344 if ((Database == NULL) || (DatabaseSize == 0)) {\r
1345 *Offset = 0;\r
1346 return FALSE;\r
1347 }\r
1348\r
1349 SigList = Database;\r
1350 SiglistSize = DatabaseSize;\r
1351 while ((SiglistSize > 0) && (SiglistSize >= SigList->SignatureListSize)) {\r
1352 if (CompareGuid (&SigList->SignatureType, SignatureType)) {\r
1353 *Offset = DatabaseSize - SiglistSize;\r
1354 return TRUE;\r
1355 }\r
1356 SiglistSize -= SigList->SignatureListSize;\r
1357 SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);\r
1358 }\r
1359 *Offset = 0;\r
1360 return FALSE;\r
1361}\r
1362\r
1363/**\r
1364 Enroll a new X509 certificate hash into Signature Database (dbx) without\r
1365 KEK's authentication.\r
1366\r
1367 @param[in] PrivateData The module's private data.\r
1368 @param[in] HashAlg The hash algorithm to enroll the certificate.\r
1369 @param[in] RevocationDate The revocation date of the certificate.\r
1370 @param[in] RevocationTime The revocation time of the certificate.\r
1371 @param[in] AlwaysRevocation Indicate whether the certificate is always revoked.\r
1372\r
1373 @retval EFI_SUCCESS New X509 is enrolled successfully.\r
1374 @retval EFI_INVALID_PARAMETER The parameter is invalid.\r
1375 @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.\r
1376\r
1377**/\r
1378EFI_STATUS\r
1379EnrollX509HashtoSigDB (\r
1380 IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,\r
1381 IN UINT32 HashAlg,\r
1382 IN EFI_HII_DATE *RevocationDate,\r
1383 IN EFI_HII_TIME *RevocationTime,\r
1384 IN BOOLEAN AlwaysRevocation\r
1385 )\r
1386{\r
1387 EFI_STATUS Status;\r
1388 UINTN X509DataSize;\r
1389 VOID *X509Data;\r
1390 EFI_SIGNATURE_LIST *SignatureList;\r
1391 UINTN SignatureListSize;\r
1392 UINT8 *Data;\r
1393 UINT8 *NewData;\r
1394 UINTN DataSize;\r
1395 UINTN DbSize;\r
1396 UINT32 Attr;\r
1397 EFI_SIGNATURE_DATA *SignatureData;\r
1398 UINTN SignatureSize;\r
1399 EFI_GUID SignatureType;\r
1400 UINTN Offset;\r
1401 UINT8 CertHash[MAX_DIGEST_SIZE];\r
1402 UINT16* FilePostFix;\r
1403 UINTN NameLength;\r
1404 EFI_TIME *Time;\r
1405\r
1406 X509DataSize = 0;\r
1407 DbSize = 0;\r
1408 X509Data = NULL;\r
1409 SignatureData = NULL;\r
1410 SignatureList = NULL;\r
1411 Data = NULL;\r
1412 NewData = NULL;\r
1413\r
1414 if ((Private->FileContext->FileName == NULL) || (Private->FileContext->FHandle == NULL) || (Private->SignatureGUID == NULL)) {\r
1415 return EFI_INVALID_PARAMETER;\r
1416 }\r
1417\r
1418 Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);\r
1419 if (EFI_ERROR (Status)) {\r
1420 return Status;\r
1421 }\r
1422\r
1423 //\r
1424 // Parse the file's postfix.\r
1425 //\r
1426 NameLength = StrLen (Private->FileContext->FileName);\r
1427 if (NameLength <= 4) {\r
1428 return EFI_INVALID_PARAMETER;\r
1429 }\r
1430 FilePostFix = Private->FileContext->FileName + NameLength - 4;\r
1431 if (!IsDerEncodeCertificate(FilePostFix)) {\r
1432 //\r
1433 // Only supports DER-encoded X509 certificate.\r
1434 //\r
1435 return EFI_INVALID_PARAMETER;\r
1436 }\r
1437\r
1438 //\r
1439 // Get the certificate from file and calculate its hash.\r
1440 //\r
1441 Status = ReadFileContent (\r
1442 Private->FileContext->FHandle,\r
1443 &X509Data,\r
1444 &X509DataSize,\r
1445 0\r
1446 );\r
1447 if (EFI_ERROR (Status)) {\r
1448 goto ON_EXIT;\r
1449 }\r
1450 ASSERT (X509Data != NULL);\r
1451\r
1452 if (!CalculateCertHash (X509Data, X509DataSize, HashAlg, CertHash)) {\r
1453 goto ON_EXIT;\r
1454 }\r
1455\r
1456 //\r
1457 // Get the variable for enrollment.\r
1458 //\r
1459 DataSize = 0;\r
1460 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
1461 if (Status == EFI_BUFFER_TOO_SMALL) {\r
1462 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
1463 if (Data == NULL) {\r
1464 return EFI_OUT_OF_RESOURCES;\r
1465 }\r
1466\r
1467 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);\r
1468 if (EFI_ERROR (Status)) {\r
1469 goto ON_EXIT;\r
1470 }\r
1471 }\r
1472\r
1473 //\r
1474 // Allocate memory for Signature and fill the Signature\r
1475 //\r
1476 SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + sizeof (EFI_TIME) + mHash[HashAlg].DigestLength;\r
1477 SignatureData = (EFI_SIGNATURE_DATA *) AllocateZeroPool (SignatureSize);\r
1478 if (SignatureData == NULL) {\r
1479 return EFI_OUT_OF_RESOURCES;\r
1480 }\r
1481 CopyGuid (&SignatureData->SignatureOwner, Private->SignatureGUID);\r
1482 CopyMem (SignatureData->SignatureData, CertHash, mHash[HashAlg].DigestLength);\r
1483\r
1484 //\r
1485 // Fill the time.\r
1486 //\r
1487 if (!AlwaysRevocation) {\r
1488 Time = (EFI_TIME *)(&SignatureData->SignatureData + mHash[HashAlg].DigestLength);\r
1489 Time->Year = RevocationDate->Year;\r
1490 Time->Month = RevocationDate->Month;\r
1491 Time->Day = RevocationDate->Day;\r
1492 Time->Hour = RevocationTime->Hour;\r
1493 Time->Minute = RevocationTime->Minute;\r
1494 Time->Second = RevocationTime->Second;\r
1495 }\r
1496\r
1497 //\r
1498 // Determine the GUID for certificate hash.\r
1499 //\r
1500 switch (HashAlg) {\r
1501 case HASHALG_SHA256:\r
1502 SignatureType = gEfiCertX509Sha256Guid;\r
1503 break;\r
1504 case HASHALG_SHA384:\r
1505 SignatureType = gEfiCertX509Sha384Guid;\r
1506 break;\r
1507 case HASHALG_SHA512:\r
1508 SignatureType = gEfiCertX509Sha512Guid;\r
1509 break;\r
1510 default:\r
1511 return FALSE;\r
1512 }\r
1513\r
1514 //\r
1515 // Add signature into the new variable data buffer\r
1516 //\r
1517 if (GetSignaturelistOffset((EFI_SIGNATURE_LIST *)Data, DataSize, &SignatureType, &Offset)) {\r
1518 //\r
1519 // Add the signature to the found signaturelist.\r
1520 //\r
1521 DbSize = DataSize + SignatureSize;\r
1522 NewData = AllocateZeroPool (DbSize);\r
1523 if (NewData == NULL) {\r
1524 Status = EFI_OUT_OF_RESOURCES;\r
1525 goto ON_EXIT;\r
1526 }\r
1527\r
1528 SignatureList = (EFI_SIGNATURE_LIST *)(Data + Offset);\r
1529 SignatureListSize = (UINTN) ReadUnaligned32 ((UINT32 *)&SignatureList->SignatureListSize);\r
1530 CopyMem (NewData, Data, Offset + SignatureListSize);\r
1531\r
1532 SignatureList = (EFI_SIGNATURE_LIST *)(NewData + Offset);\r
1533 WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureListSize, (UINT32)(SignatureListSize + SignatureSize));\r
1534\r
1535 Offset += SignatureListSize;\r
1536 CopyMem (NewData + Offset, SignatureData, SignatureSize);\r
1537 CopyMem (NewData + Offset + SignatureSize, Data + Offset, DataSize - Offset);\r
1538\r
1539 FreePool (Data);\r
1540 Data = NewData;\r
1541 DataSize = DbSize;\r
1542 } else {\r
1543 //\r
1544 // Create a new signaturelist, and add the signature into the signaturelist.\r
1545 //\r
1546 DbSize = DataSize + sizeof(EFI_SIGNATURE_LIST) + SignatureSize;\r
1547 NewData = AllocateZeroPool (DbSize);\r
1548 if (NewData == NULL) {\r
1549 Status = EFI_OUT_OF_RESOURCES;\r
1550 goto ON_EXIT;\r
1551 }\r
1552 //\r
1553 // Fill Certificate Database parameters.\r
1554 //\r
1555 SignatureList = (EFI_SIGNATURE_LIST*) (NewData + DataSize);\r
1556 SignatureListSize = sizeof(EFI_SIGNATURE_LIST) + SignatureSize;\r
1557 WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureListSize, (UINT32) SignatureListSize);\r
1558 WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureSize, (UINT32) SignatureSize);\r
1559 CopyGuid (&SignatureList->SignatureType, &SignatureType);\r
1560 CopyMem ((UINT8* ) SignatureList + sizeof (EFI_SIGNATURE_LIST), SignatureData, SignatureSize);\r
1561 if ((DataSize != 0) && (Data != NULL)) {\r
1562 CopyMem (NewData, Data, DataSize);\r
1563 FreePool (Data);\r
1564 }\r
1565 Data = NewData;\r
1566 DataSize = DbSize;\r
1567 }\r
1568\r
1569 Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &Data);\r
1570 if (EFI_ERROR (Status)) {\r
1571 goto ON_EXIT;\r
1572 }\r
1573\r
1574 Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r
1575 | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
1576 Status = gRT->SetVariable(\r
1577 EFI_IMAGE_SECURITY_DATABASE1,\r
1578 &gEfiImageSecurityDatabaseGuid,\r
1579 Attr,\r
1580 DataSize,\r
1581 Data\r
1582 );\r
1583 if (EFI_ERROR (Status)) {\r
1584 goto ON_EXIT;\r
1585 }\r
1586\r
1587ON_EXIT:\r
762d8ddb 1588\r
4de754e1 1589 CloseEnrolledFile(Private->FileContext);\r
ecc722ad 1590\r
1591 if (Private->SignatureGUID != NULL) {\r
1592 FreePool (Private->SignatureGUID);\r
1593 Private->SignatureGUID = NULL;\r
1594 }\r
1595\r
20333c6d
QL
1596 if (Data != NULL) {\r
1597 FreePool (Data);\r
ecc722ad 1598 }\r
1599\r
20333c6d
QL
1600 if (SignatureData != NULL) {\r
1601 FreePool (SignatureData);\r
ecc722ad 1602 }\r
1603\r
20333c6d
QL
1604 if (X509Data != NULL) {\r
1605 FreePool (X509Data);\r
f71ed839 1606 }\r
1607\r
20333c6d 1608 return Status;\r
ecc722ad 1609}\r
1610\r
1611/**\r
20333c6d 1612 Check whether a certificate from a file exists in dbx.\r
ecc722ad 1613\r
1614 @param[in] PrivateData The module's private data.\r
20333c6d
QL
1615 @param[in] VariableName Variable name of signature database, must be\r
1616 EFI_IMAGE_SECURITY_DATABASE1.\r
ecc722ad 1617\r
20333c6d
QL
1618 @retval TRUE The X509 certificate is found in dbx successfully.\r
1619 @retval FALSE The X509 certificate is not found in dbx.\r
ecc722ad 1620**/\r
20333c6d
QL
1621BOOLEAN\r
1622IsX509CertInDbx (\r
ecc722ad 1623 IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,\r
1624 IN CHAR16 *VariableName\r
20333c6d 1625 )\r
ecc722ad 1626{\r
20333c6d
QL
1627 EFI_STATUS Status;\r
1628 UINTN X509DataSize;\r
1629 VOID *X509Data;\r
1630 BOOLEAN IsFound;\r
ecc722ad 1631\r
20333c6d
QL
1632 //\r
1633 // Read the certificate from file\r
1634 //\r
ecc722ad 1635 X509DataSize = 0;\r
ecc722ad 1636 X509Data = NULL;\r
ecc722ad 1637 Status = ReadFileContent (\r
1638 Private->FileContext->FHandle,\r
1639 &X509Data,\r
1640 &X509DataSize,\r
1641 0\r
1642 );\r
1643 if (EFI_ERROR (Status)) {\r
20333c6d 1644 return FALSE;\r
ecc722ad 1645 }\r
1646\r
1647 //\r
20333c6d 1648 // Check the raw certificate.\r
ecc722ad 1649 //\r
20333c6d
QL
1650 IsFound = FALSE;\r
1651 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, X509Data, X509DataSize)) {\r
1652 IsFound = TRUE;\r
8c1babfd 1653 goto ON_EXIT;\r
1654 }\r
ecc722ad 1655\r
20333c6d
QL
1656 //\r
1657 // Check the hash of certificate.\r
1658 //\r
1659 if (IsCertHashFoundInDbx (X509Data, X509DataSize)) {\r
1660 IsFound = TRUE;\r
ecc722ad 1661 goto ON_EXIT;\r
1662 }\r
1663\r
1664ON_EXIT:\r
ecc722ad 1665 if (X509Data != NULL) {\r
1666 FreePool (X509Data);\r
1667 }\r
1668\r
20333c6d 1669 return IsFound;\r
ecc722ad 1670}\r
1671\r
5e9dfc67
LG
1672/**\r
1673 Reads contents of a PE/COFF image in memory buffer.\r
1674\r
1675 Caution: This function may receive untrusted input.\r
1676 PE/COFF image is external input, so this function will make sure the PE/COFF image content\r
1677 read is within the image buffer.\r
1678\r
1679 @param FileHandle Pointer to the file handle to read the PE/COFF image.\r
1680 @param FileOffset Offset into the PE/COFF image to begin the read operation.\r
1681 @param ReadSize On input, the size in bytes of the requested read operation.\r
1682 On output, the number of bytes actually read.\r
1683 @param Buffer Output buffer that contains the data read from the PE/COFF image.\r
1684\r
1685 @retval EFI_SUCCESS The specified portion of the PE/COFF image was read and the size\r
1686**/\r
1687EFI_STATUS\r
1688EFIAPI\r
1689SecureBootConfigImageRead (\r
1690 IN VOID *FileHandle,\r
1691 IN UINTN FileOffset,\r
1692 IN OUT UINTN *ReadSize,\r
1693 OUT VOID *Buffer\r
1694 )\r
1695{\r
1696 UINTN EndPosition;\r
1697\r
1698 if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {\r
1699 return EFI_INVALID_PARAMETER;\r
1700 }\r
1701\r
1702 if (MAX_ADDRESS - FileOffset < *ReadSize) {\r
1703 return EFI_INVALID_PARAMETER;\r
1704 }\r
1705\r
1706 EndPosition = FileOffset + *ReadSize;\r
1707 if (EndPosition > mImageSize) {\r
1708 *ReadSize = (UINT32)(mImageSize - FileOffset);\r
1709 }\r
1710\r
1711 if (FileOffset >= mImageSize) {\r
1712 *ReadSize = 0;\r
1713 }\r
1714\r
1715 CopyMem (Buffer, (UINT8 *)((UINTN) FileHandle + FileOffset), *ReadSize);\r
1716\r
1717 return EFI_SUCCESS;\r
1718}\r
1719\r
ecc722ad 1720/**\r
1721 Load PE/COFF image information into internal buffer and check its validity.\r
1722\r
1723 @retval EFI_SUCCESS Successful\r
1724 @retval EFI_UNSUPPORTED Invalid PE/COFF file\r
1725 @retval EFI_ABORTED Serious error occurs, like file I/O error etc.\r
1726\r
1727**/\r
1728EFI_STATUS\r
1729LoadPeImage (\r
20333c6d
QL
1730 VOID\r
1731 )\r
ecc722ad 1732{\r
1733 EFI_IMAGE_DOS_HEADER *DosHdr;\r
1734 EFI_IMAGE_NT_HEADERS32 *NtHeader32;\r
1735 EFI_IMAGE_NT_HEADERS64 *NtHeader64;\r
5e9dfc67
LG
1736 PE_COFF_LOADER_IMAGE_CONTEXT ImageContext;\r
1737 EFI_STATUS Status;\r
ecc722ad 1738\r
1739 NtHeader32 = NULL;\r
1740 NtHeader64 = NULL;\r
5e9dfc67
LG
1741\r
1742 ZeroMem (&ImageContext, sizeof (ImageContext));\r
1743 ImageContext.Handle = (VOID *) mImageBase;\r
1744 ImageContext.ImageRead = (PE_COFF_LOADER_READ_FILE) SecureBootConfigImageRead;\r
1745\r
1746 //\r
1747 // Get information about the image being loaded\r
1748 //\r
1749 Status = PeCoffLoaderGetImageInfo (&ImageContext);\r
1750 if (EFI_ERROR (Status)) {\r
1751 //\r
1752 // The information can't be got from the invalid PeImage\r
1753 //\r
1754 DEBUG ((DEBUG_INFO, "SecureBootConfigDxe: PeImage invalid. \n"));\r
1755 return Status;\r
1756 }\r
1757\r
ecc722ad 1758 //\r
1759 // Read the Dos header\r
1760 //\r
1761 DosHdr = (EFI_IMAGE_DOS_HEADER*)(mImageBase);\r
1762 if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE)\r
1763 {\r
1764 //\r
20333c6d 1765 // DOS image header is present,\r
ecc722ad 1766 // So read the PE header after the DOS image header\r
1767 //\r
1768 mPeCoffHeaderOffset = DosHdr->e_lfanew;\r
1769 }\r
1770 else\r
1771 {\r
1772 mPeCoffHeaderOffset = 0;\r
1773 }\r
1774\r
1775 //\r
1776 // Read PE header and check the signature validity and machine compatibility\r
1777 //\r
1778 NtHeader32 = (EFI_IMAGE_NT_HEADERS32*) (mImageBase + mPeCoffHeaderOffset);\r
1779 if (NtHeader32->Signature != EFI_IMAGE_NT_SIGNATURE)\r
1780 {\r
1781 return EFI_UNSUPPORTED;\r
1782 }\r
1783\r
1784 mNtHeader.Pe32 = NtHeader32;\r
1785\r
1786 //\r
1787 // Check the architecture field of PE header and get the Certificate Data Directory data\r
1788 // Note the size of FileHeader field is constant for both IA32 and X64 arch\r
1789 //\r
20333c6d 1790 if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA32)\r
a16170a1
AB
1791 || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_EBC)\r
1792 || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_ARMTHUMB_MIXED)) {\r
ecc722ad 1793 //\r
a16170a1 1794 // 32-bits Architecture\r
ecc722ad 1795 //\r
1796 mImageType = ImageType_IA32;\r
1797 mSecDataDir = (EFI_IMAGE_SECURITY_DATA_DIRECTORY*) &(NtHeader32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]);\r
1798 }\r
1799 else if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA64)\r
a16170a1
AB
1800 || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_X64)\r
1801 || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_AARCH64)) {\r
ecc722ad 1802 //\r
1803 // 64-bits Architecture\r
1804 //\r
1805 mImageType = ImageType_X64;\r
1806 NtHeader64 = (EFI_IMAGE_NT_HEADERS64 *) (mImageBase + mPeCoffHeaderOffset);\r
1807 mSecDataDir = (EFI_IMAGE_SECURITY_DATA_DIRECTORY*) &(NtHeader64->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]);\r
1808 } else {\r
1809 return EFI_UNSUPPORTED;\r
1810 }\r
1811\r
1812 return EFI_SUCCESS;\r
1813}\r
1814\r
1815/**\r
1816 Calculate hash of Pe/Coff image based on the authenticode image hashing in\r
1817 PE/COFF Specification 8.0 Appendix A\r
1818\r
b3548d32 1819 Notes: PE/COFF image has been checked by BasePeCoffLib PeCoffLoaderGetImageInfo() in\r
5e9dfc67
LG
1820 the function LoadPeImage ().\r
1821\r
ecc722ad 1822 @param[in] HashAlg Hash algorithm type.\r
20333c6d 1823\r
ecc722ad 1824 @retval TRUE Successfully hash image.\r
1825 @retval FALSE Fail in hash image.\r
1826\r
1827**/\r
20333c6d 1828BOOLEAN\r
ecc722ad 1829HashPeImage (\r
1830 IN UINT32 HashAlg\r
1831 )\r
1832{\r
1833 BOOLEAN Status;\r
ecc722ad 1834 EFI_IMAGE_SECTION_HEADER *Section;\r
1835 VOID *HashCtx;\r
1836 UINTN CtxSize;\r
1837 UINT8 *HashBase;\r
1838 UINTN HashSize;\r
1839 UINTN SumOfBytesHashed;\r
1840 EFI_IMAGE_SECTION_HEADER *SectionHeader;\r
1841 UINTN Index;\r
1842 UINTN Pos;\r
1843\r
1844 HashCtx = NULL;\r
1845 SectionHeader = NULL;\r
1846 Status = FALSE;\r
1847\r
c035e373 1848 if (HashAlg != HASHALG_SHA256) {\r
ecc722ad 1849 return FALSE;\r
1850 }\r
20333c6d 1851\r
ecc722ad 1852 //\r
1853 // Initialize context of hash.\r
1854 //\r
1855 ZeroMem (mImageDigest, MAX_DIGEST_SIZE);\r
1856\r
c035e373
ZL
1857 mImageDigestSize = SHA256_DIGEST_SIZE;\r
1858 mCertType = gEfiCertSha256Guid;\r
ecc722ad 1859\r
1860 CtxSize = mHash[HashAlg].GetContextSize();\r
20333c6d 1861\r
ecc722ad 1862 HashCtx = AllocatePool (CtxSize);\r
1863 ASSERT (HashCtx != NULL);\r
1864\r
1865 // 1. Load the image header into memory.\r
1866\r
1867 // 2. Initialize a SHA hash context.\r
1868 Status = mHash[HashAlg].HashInit(HashCtx);\r
1869 if (!Status) {\r
1870 goto Done;\r
1871 }\r
1872 //\r
1873 // Measuring PE/COFF Image Header;\r
1874 // But CheckSum field and SECURITY data directory (certificate) are excluded\r
1875 //\r
20333c6d 1876\r
ecc722ad 1877 //\r
1878 // 3. Calculate the distance from the base of the image header to the image checksum address.\r
1879 // 4. Hash the image header from its base to beginning of the image checksum.\r
1880 //\r
1881 HashBase = mImageBase;\r
f199664c 1882 if (mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
ecc722ad 1883 //\r
1884 // Use PE32 offset.\r
1885 //\r
4333b99d 1886 HashSize = (UINTN) (&mNtHeader.Pe32->OptionalHeader.CheckSum) - (UINTN) HashBase;\r
ecc722ad 1887 } else {\r
1888 //\r
1889 // Use PE32+ offset.\r
1890 //\r
4333b99d 1891 HashSize = (UINTN) (&mNtHeader.Pe32Plus->OptionalHeader.CheckSum) - (UINTN) HashBase;\r
ecc722ad 1892 }\r
1893\r
1894 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
1895 if (!Status) {\r
1896 goto Done;\r
1897 }\r
1898 //\r
1899 // 5. Skip over the image checksum (it occupies a single ULONG).\r
1900 // 6. Get the address of the beginning of the Cert Directory.\r
1901 // 7. Hash everything from the end of the checksum to the start of the Cert Directory.\r
1902 //\r
f199664c 1903 if (mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
ecc722ad 1904 //\r
1905 // Use PE32 offset.\r
1906 //\r
1907 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);\r
4333b99d 1908 HashSize = (UINTN) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - (UINTN) HashBase;\r
ecc722ad 1909 } else {\r
1910 //\r
1911 // Use PE32+ offset.\r
20333c6d 1912 //\r
ecc722ad 1913 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);\r
4333b99d 1914 HashSize = (UINTN) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - (UINTN) HashBase;\r
ecc722ad 1915 }\r
1916\r
1917 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
1918 if (!Status) {\r
1919 goto Done;\r
1920 }\r
1921 //\r
1922 // 8. Skip over the Cert Directory. (It is sizeof(IMAGE_DATA_DIRECTORY) bytes.)\r
1923 // 9. Hash everything from the end of the Cert Directory to the end of image header.\r
1924 //\r
f199664c 1925 if (mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
ecc722ad 1926 //\r
1927 // Use PE32 offset\r
1928 //\r
1929 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];\r
4333b99d 1930 HashSize = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders - ((UINTN) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1]) - (UINTN) mImageBase);\r
ecc722ad 1931 } else {\r
1932 //\r
1933 // Use PE32+ offset.\r
1934 //\r
1935 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];\r
4333b99d 1936 HashSize = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders - ((UINTN) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1]) - (UINTN) mImageBase);\r
ecc722ad 1937 }\r
1938\r
1939 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
1940 if (!Status) {\r
1941 goto Done;\r
1942 }\r
1943 //\r
1944 // 10. Set the SUM_OF_BYTES_HASHED to the size of the header.\r
1945 //\r
f199664c 1946 if (mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
ecc722ad 1947 //\r
1948 // Use PE32 offset.\r
1949 //\r
1950 SumOfBytesHashed = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders;\r
1951 } else {\r
1952 //\r
1953 // Use PE32+ offset\r
1954 //\r
1955 SumOfBytesHashed = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders;\r
1956 }\r
1957\r
1958 //\r
1959 // 11. Build a temporary table of pointers to all the IMAGE_SECTION_HEADER\r
1960 // structures in the image. The 'NumberOfSections' field of the image\r
1961 // header indicates how big the table should be. Do not include any\r
1962 // IMAGE_SECTION_HEADERs in the table whose 'SizeOfRawData' field is zero.\r
1963 //\r
1964 SectionHeader = (EFI_IMAGE_SECTION_HEADER *) AllocateZeroPool (sizeof (EFI_IMAGE_SECTION_HEADER) * mNtHeader.Pe32->FileHeader.NumberOfSections);\r
1965 ASSERT (SectionHeader != NULL);\r
1966 //\r
1967 // 12. Using the 'PointerToRawData' in the referenced section headers as\r
1968 // a key, arrange the elements in the table in ascending order. In other\r
1969 // words, sort the section headers according to the disk-file offset of\r
1970 // the section.\r
1971 //\r
1972 Section = (EFI_IMAGE_SECTION_HEADER *) (\r
1973 mImageBase +\r
1974 mPeCoffHeaderOffset +\r
1975 sizeof (UINT32) +\r
1976 sizeof (EFI_IMAGE_FILE_HEADER) +\r
1977 mNtHeader.Pe32->FileHeader.SizeOfOptionalHeader\r
1978 );\r
1979 for (Index = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++) {\r
1980 Pos = Index;\r
1981 while ((Pos > 0) && (Section->PointerToRawData < SectionHeader[Pos - 1].PointerToRawData)) {\r
1982 CopyMem (&SectionHeader[Pos], &SectionHeader[Pos - 1], sizeof (EFI_IMAGE_SECTION_HEADER));\r
1983 Pos--;\r
1984 }\r
1985 CopyMem (&SectionHeader[Pos], Section, sizeof (EFI_IMAGE_SECTION_HEADER));\r
1986 Section += 1;\r
1987 }\r
1988\r
1989 //\r
1990 // 13. Walk through the sorted table, bring the corresponding section\r
1991 // into memory, and hash the entire section (using the 'SizeOfRawData'\r
1992 // field in the section header to determine the amount of data to hash).\r
1993 // 14. Add the section's 'SizeOfRawData' to SUM_OF_BYTES_HASHED .\r
1994 // 15. Repeat steps 13 and 14 for all the sections in the sorted table.\r
1995 //\r
1996 for (Index = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++) {\r
1997 Section = &SectionHeader[Index];\r
1998 if (Section->SizeOfRawData == 0) {\r
1999 continue;\r
2000 }\r
2001 HashBase = mImageBase + Section->PointerToRawData;\r
2002 HashSize = (UINTN) Section->SizeOfRawData;\r
2003\r
2004 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
2005 if (!Status) {\r
2006 goto Done;\r
2007 }\r
2008\r
2009 SumOfBytesHashed += HashSize;\r
2010 }\r
2011\r
2012 //\r
2013 // 16. If the file size is greater than SUM_OF_BYTES_HASHED, there is extra\r
2014 // data in the file that needs to be added to the hash. This data begins\r
2015 // at file offset SUM_OF_BYTES_HASHED and its length is:\r
2016 // FileSize - (CertDirectory->Size)\r
2017 //\r
2018 if (mImageSize > SumOfBytesHashed) {\r
2019 HashBase = mImageBase + SumOfBytesHashed;\r
f199664c 2020 if (mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
ecc722ad 2021 //\r
2022 // Use PE32 offset.\r
2023 //\r
2024 HashSize = (UINTN)(\r
2025 mImageSize -\r
2026 mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size -\r
2027 SumOfBytesHashed);\r
2028 } else {\r
2029 //\r
2030 // Use PE32+ offset.\r
2031 //\r
2032 HashSize = (UINTN)(\r
2033 mImageSize -\r
2034 mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size -\r
20333c6d 2035 SumOfBytesHashed);\r
ecc722ad 2036 }\r
2037\r
2038 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
2039 if (!Status) {\r
2040 goto Done;\r
2041 }\r
2042 }\r
2043\r
2044 Status = mHash[HashAlg].HashFinal(HashCtx, mImageDigest);\r
2045\r
2046Done:\r
2047 if (HashCtx != NULL) {\r
2048 FreePool (HashCtx);\r
2049 }\r
2050 if (SectionHeader != NULL) {\r
2051 FreePool (SectionHeader);\r
2052 }\r
2053 return Status;\r
2054}\r
2055\r
2056/**\r
69f8bb52 2057 Recognize the Hash algorithm in PE/COFF Authenticode and calculate hash of\r
20333c6d 2058 Pe/Coff image based on the authenticated image hashing in PE/COFF Specification\r
ecc722ad 2059 8.0 Appendix A\r
2060\r
2061 @retval EFI_UNSUPPORTED Hash algorithm is not supported.\r
2062 @retval EFI_SUCCESS Hash successfully.\r
2063\r
2064**/\r
20333c6d 2065EFI_STATUS\r
ecc722ad 2066HashPeImageByType (\r
2067 VOID\r
2068 )\r
2069{\r
2070 UINT8 Index;\r
2071 WIN_CERTIFICATE_EFI_PKCS *PkcsCertData;\r
2072\r
2073 PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) (mImageBase + mSecDataDir->Offset);\r
2074\r
20333c6d 2075 for (Index = 0; Index < HASHALG_MAX; Index++) {\r
ecc722ad 2076 //\r
2077 // Check the Hash algorithm in PE/COFF Authenticode.\r
20333c6d 2078 // According to PKCS#7 Definition:\r
ecc722ad 2079 // SignedData ::= SEQUENCE {\r
2080 // version Version,\r
2081 // digestAlgorithms DigestAlgorithmIdentifiers,\r
2082 // contentInfo ContentInfo,\r
2083 // .... }\r
2084 // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing\r
2085 // This field has the fixed offset (+32) in final Authenticode ASN.1 data.\r
2086 // Fixed offset (+32) is calculated based on two bytes of length encoding.\r
2087 //\r
2088 if ((*(PkcsCertData->CertData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {\r
2089 //\r
2090 // Only support two bytes of Long Form of Length Encoding.\r
2091 //\r
2092 continue;\r
2093 }\r
2094\r
20333c6d 2095 //\r
ecc722ad 2096 if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {\r
2097 break;\r
2098 }\r
2099 }\r
2100\r
2101 if (Index == HASHALG_MAX) {\r
2102 return EFI_UNSUPPORTED;\r
2103 }\r
2104\r
2105 //\r
2106 // HASH PE Image based on Hash algorithm in PE/COFF Authenticode.\r
2107 //\r
2108 if (!HashPeImage(Index)) {\r
2109 return EFI_UNSUPPORTED;\r
2110 }\r
2111\r
2112 return EFI_SUCCESS;\r
2113}\r
2114\r
4de754e1
ZC
2115/**\r
2116 Enroll a new executable's signature into Signature Database.\r
2117\r
2118 @param[in] PrivateData The module's private data.\r
2119 @param[in] VariableName Variable name of signature database, must be\r
2120 EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1\r
2121 or EFI_IMAGE_SECURITY_DATABASE2.\r
2122\r
2123 @retval EFI_SUCCESS New signature is enrolled successfully.\r
2124 @retval EFI_INVALID_PARAMETER The parameter is invalid.\r
2125 @retval EFI_UNSUPPORTED Unsupported command.\r
2126 @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.\r
2127\r
2128**/\r
2129EFI_STATUS\r
2130EnrollAuthentication2Descriptor (\r
2131 IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,\r
2132 IN CHAR16 *VariableName\r
2133 )\r
2134{\r
2135 EFI_STATUS Status;\r
2136 VOID *Data;\r
2137 UINTN DataSize;\r
2138 UINT32 Attr;\r
2139\r
2140 Data = NULL;\r
2141\r
2142 //\r
2143 // DBT only support DER-X509 Cert Enrollment\r
2144 //\r
2145 if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {\r
2146 return EFI_UNSUPPORTED;\r
2147 }\r
2148\r
2149 //\r
2150 // Read the whole file content\r
2151 //\r
2152 Status = ReadFileContent(\r
2153 Private->FileContext->FHandle,\r
2154 (VOID **) &mImageBase,\r
2155 &mImageSize,\r
2156 0\r
2157 );\r
2158 if (EFI_ERROR (Status)) {\r
2159 goto ON_EXIT;\r
2160 }\r
2161 ASSERT (mImageBase != NULL);\r
2162\r
2163 Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r
2164 | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
2165\r
2166 //\r
2167 // Check if SigDB variable has been already existed.\r
2168 // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the\r
2169 // new signature data to original variable\r
2170 //\r
2171 DataSize = 0;\r
2172 Status = gRT->GetVariable(\r
2173 VariableName,\r
2174 &gEfiImageSecurityDatabaseGuid,\r
2175 NULL,\r
2176 &DataSize,\r
2177 NULL\r
2178 );\r
2179 if (Status == EFI_BUFFER_TOO_SMALL) {\r
2180 Attr |= EFI_VARIABLE_APPEND_WRITE;\r
2181 } else if (Status != EFI_NOT_FOUND) {\r
2182 goto ON_EXIT;\r
2183 }\r
2184\r
2185 //\r
2186 // Diretly set AUTHENTICATION_2 data to SetVariable\r
2187 //\r
2188 Status = gRT->SetVariable(\r
2189 VariableName,\r
2190 &gEfiImageSecurityDatabaseGuid,\r
2191 Attr,\r
2192 mImageSize,\r
2193 mImageBase\r
2194 );\r
2195\r
2196 DEBUG((DEBUG_INFO, "Enroll AUTH_2 data to Var:%s Status: %x\n", VariableName, Status));\r
2197\r
2198ON_EXIT:\r
2199\r
2200 CloseEnrolledFile(Private->FileContext);\r
2201\r
2202 if (Data != NULL) {\r
2203 FreePool (Data);\r
2204 }\r
2205\r
2206 if (mImageBase != NULL) {\r
2207 FreePool (mImageBase);\r
2208 mImageBase = NULL;\r
2209 }\r
2210\r
2211 return Status;\r
2212\r
2213}\r
2214\r
2215\r
ecc722ad 2216/**\r
20333c6d 2217 Enroll a new executable's signature into Signature Database.\r
ecc722ad 2218\r
2219 @param[in] PrivateData The module's private data.\r
20333c6d
QL
2220 @param[in] VariableName Variable name of signature database, must be\r
2221 EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1\r
2222 or EFI_IMAGE_SECURITY_DATABASE2.\r
ecc722ad 2223\r
2224 @retval EFI_SUCCESS New signature is enrolled successfully.\r
2225 @retval EFI_INVALID_PARAMETER The parameter is invalid.\r
2226 @retval EFI_UNSUPPORTED Unsupported command.\r
2227 @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.\r
2228\r
2229**/\r
2230EFI_STATUS\r
2231EnrollImageSignatureToSigDB (\r
2232 IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,\r
2233 IN CHAR16 *VariableName\r
2234 )\r
2235{\r
2236 EFI_STATUS Status;\r
2237 EFI_SIGNATURE_LIST *SigDBCert;\r
2238 EFI_SIGNATURE_DATA *SigDBCertData;\r
2239 VOID *Data;\r
2240 UINTN DataSize;\r
2241 UINTN SigDBSize;\r
2242 UINT32 Attr;\r
2243 WIN_CERTIFICATE_UEFI_GUID *GuidCertData;\r
2244\r
2245 Data = NULL;\r
2246 GuidCertData = NULL;\r
ecc722ad 2247\r
20333c6d
QL
2248 if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {\r
2249 return EFI_UNSUPPORTED;\r
2250 }\r
2251\r
ecc722ad 2252 //\r
2253 // Form the SigDB certificate list.\r
2254 // Format the data item into EFI_SIGNATURE_LIST type.\r
2255 //\r
2256 // We need to parse executable's signature data from specified signed executable file.\r
2257 // In current implementation, we simply trust the pass-in signed executable file.\r
2258 // In reality, it's OS's responsibility to verify the signed executable file.\r
2259 //\r
2260\r
2261 //\r
2262 // Read the whole file content\r
2263 //\r
2264 Status = ReadFileContent(\r
2265 Private->FileContext->FHandle,\r
20333c6d
QL
2266 (VOID **) &mImageBase,\r
2267 &mImageSize,\r
ecc722ad 2268 0\r
2269 );\r
2270 if (EFI_ERROR (Status)) {\r
2271 goto ON_EXIT;\r
20333c6d 2272 }\r
ba57d4fd 2273 ASSERT (mImageBase != NULL);\r
ecc722ad 2274\r
2275 Status = LoadPeImage ();\r
2276 if (EFI_ERROR (Status)) {\r
2277 goto ON_EXIT;\r
2278 }\r
2279\r
2280 if (mSecDataDir->SizeOfCert == 0) {\r
2281 if (!HashPeImage (HASHALG_SHA256)) {\r
2282 Status = EFI_SECURITY_VIOLATION;\r
2283 goto ON_EXIT;\r
2284 }\r
2285 } else {\r
20333c6d 2286\r
ecc722ad 2287 //\r
2288 // Read the certificate data\r
2289 //\r
2290 mCertificate = (WIN_CERTIFICATE *)(mImageBase + mSecDataDir->Offset);\r
2291\r
2292 if (mCertificate->wCertificateType == WIN_CERT_TYPE_EFI_GUID) {\r
2293 GuidCertData = (WIN_CERTIFICATE_UEFI_GUID*) mCertificate;\r
2294 if (CompareMem (&GuidCertData->CertType, &gEfiCertTypeRsa2048Sha256Guid, sizeof(EFI_GUID)) != 0) {\r
2295 Status = EFI_ABORTED;\r
2296 goto ON_EXIT;\r
2297 }\r
2298\r
2299 if (!HashPeImage (HASHALG_SHA256)) {\r
2300 Status = EFI_ABORTED;\r
2301 goto ON_EXIT;;\r
2302 }\r
20333c6d 2303\r
ecc722ad 2304 } else if (mCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {\r
2305\r
2306 Status = HashPeImageByType ();\r
2307 if (EFI_ERROR (Status)) {\r
2308 goto ON_EXIT;;\r
2309 }\r
2310 } else {\r
2311 Status = EFI_ABORTED;\r
2312 goto ON_EXIT;\r
2313 }\r
2314 }\r
2315\r
2316 //\r
2317 // Create a new SigDB entry.\r
2318 //\r
20333c6d 2319 SigDBSize = sizeof(EFI_SIGNATURE_LIST)\r
ecc722ad 2320 + sizeof(EFI_SIGNATURE_DATA) - 1\r
2321 + (UINT32) mImageDigestSize;\r
2322\r
2323 Data = (UINT8*) AllocateZeroPool (SigDBSize);\r
2324 if (Data == NULL) {\r
2325 Status = EFI_OUT_OF_RESOURCES;\r
2326 goto ON_EXIT;\r
2327 }\r
20333c6d 2328\r
ecc722ad 2329 //\r
2330 // Adjust the Certificate Database parameters.\r
20333c6d 2331 //\r
ecc722ad 2332 SigDBCert = (EFI_SIGNATURE_LIST*) Data;\r
2333 SigDBCert->SignatureListSize = (UINT32) SigDBSize;\r
2334 SigDBCert->SignatureHeaderSize = 0;\r
2335 SigDBCert->SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + (UINT32) mImageDigestSize;\r
2336 CopyGuid (&SigDBCert->SignatureType, &mCertType);\r
2337\r
2338 SigDBCertData = (EFI_SIGNATURE_DATA*)((UINT8*)SigDBCert + sizeof(EFI_SIGNATURE_LIST));\r
2339 CopyGuid (&SigDBCertData->SignatureOwner, Private->SignatureGUID);\r
2340 CopyMem (SigDBCertData->SignatureData, mImageDigest, mImageDigestSize);\r
2341\r
20333c6d 2342 Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r
8c1babfd 2343 | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
2344 Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);\r
2345 if (EFI_ERROR (Status)) {\r
2346 DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
2347 goto ON_EXIT;\r
2348 }\r
20333c6d 2349\r
ecc722ad 2350 //\r
20333c6d
QL
2351 // Check if SigDB variable has been already existed.\r
2352 // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the\r
ecc722ad 2353 // new signature data to original variable\r
20333c6d 2354 //\r
ecc722ad 2355 DataSize = 0;\r
2356 Status = gRT->GetVariable(\r
20333c6d
QL
2357 VariableName,\r
2358 &gEfiImageSecurityDatabaseGuid,\r
2359 NULL,\r
2360 &DataSize,\r
ecc722ad 2361 NULL\r
2362 );\r
2363 if (Status == EFI_BUFFER_TOO_SMALL) {\r
2364 Attr |= EFI_VARIABLE_APPEND_WRITE;\r
2365 } else if (Status != EFI_NOT_FOUND) {\r
2366 goto ON_EXIT;\r
20333c6d 2367 }\r
ecc722ad 2368\r
2369 //\r
2370 // Enroll the variable.\r
2371 //\r
2372 Status = gRT->SetVariable(\r
20333c6d
QL
2373 VariableName,\r
2374 &gEfiImageSecurityDatabaseGuid,\r
2375 Attr,\r
2376 SigDBSize,\r
ecc722ad 2377 Data\r
2378 );\r
2379 if (EFI_ERROR (Status)) {\r
2380 goto ON_EXIT;\r
2381 }\r
2382\r
2383ON_EXIT:\r
2384\r
4de754e1 2385 CloseEnrolledFile(Private->FileContext);\r
ecc722ad 2386\r
2387 if (Private->SignatureGUID != NULL) {\r
2388 FreePool (Private->SignatureGUID);\r
2389 Private->SignatureGUID = NULL;\r
2390 }\r
2391\r
2392 if (Data != NULL) {\r
2393 FreePool (Data);\r
2394 }\r
2395\r
2396 if (mImageBase != NULL) {\r
2397 FreePool (mImageBase);\r
2398 mImageBase = NULL;\r
2399 }\r
2400\r
2401 return Status;\r
2402}\r
2403\r
2404/**\r
20333c6d 2405 Enroll signature into DB/DBX/DBT without KEK's authentication.\r
ecc722ad 2406 The SignatureOwner GUID will be Private->SignatureGUID.\r
20333c6d 2407\r
ecc722ad 2408 @param[in] PrivateData The module's private data.\r
20333c6d 2409 @param[in] VariableName Variable name of signature database, must be\r
ecc722ad 2410 EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.\r
20333c6d 2411\r
ecc722ad 2412 @retval EFI_SUCCESS New signature enrolled successfully.\r
2413 @retval EFI_INVALID_PARAMETER The parameter is invalid.\r
2414 @retval others Fail to enroll signature data.\r
20333c6d 2415\r
ecc722ad 2416**/\r
2417EFI_STATUS\r
2418EnrollSignatureDatabase (\r
2419 IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,\r
2420 IN CHAR16 *VariableName\r
20333c6d 2421 )\r
ecc722ad 2422{\r
2423 UINT16* FilePostFix;\r
f71ed839 2424 EFI_STATUS Status;\r
fd64f84f 2425 UINTN NameLength;\r
ecc722ad 2426\r
2427 if ((Private->FileContext->FileName == NULL) || (Private->FileContext->FHandle == NULL) || (Private->SignatureGUID == NULL)) {\r
2428 return EFI_INVALID_PARAMETER;\r
2429 }\r
2430\r
20333c6d 2431 Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);\r
f71ed839 2432 if (EFI_ERROR (Status)) {\r
2433 return Status;\r
2434 }\r
20333c6d 2435\r
ecc722ad 2436 //\r
20333c6d 2437 // Parse the file's postfix.\r
ecc722ad 2438 //\r
fd64f84f
GCPL
2439 NameLength = StrLen (Private->FileContext->FileName);\r
2440 if (NameLength <= 4) {\r
2441 return EFI_INVALID_PARAMETER;\r
2442 }\r
2443 FilePostFix = Private->FileContext->FileName + NameLength - 4;\r
20333c6d 2444 if (IsDerEncodeCertificate (FilePostFix)) {\r
ecc722ad 2445 //\r
e4d7370d 2446 // Supports DER-encoded X509 certificate.\r
ecc722ad 2447 //\r
2448 return EnrollX509toSigDB (Private, VariableName);\r
4de754e1
ZC
2449 } else if (IsAuthentication2Format(Private->FileContext->FHandle)){\r
2450 return EnrollAuthentication2Descriptor(Private, VariableName);\r
2451 } else {\r
2452 return EnrollImageSignatureToSigDB (Private, VariableName);\r
ecc722ad 2453 }\r
ecc722ad 2454}\r
2455\r
2456/**\r
20333c6d 2457 List all signatures in specified signature database (e.g. KEK/DB/DBX/DBT)\r
ecc722ad 2458 by GUID in the page for user to select and delete as needed.\r
2459\r
2460 @param[in] PrivateData Module's private data.\r
2461 @param[in] VariableName The variable name of the vendor's signature database.\r
2462 @param[in] VendorGuid A unique identifier for the vendor.\r
2463 @param[in] LabelNumber Label number to insert opcodes.\r
2464 @param[in] FormId Form ID of current page.\r
2465 @param[in] QuestionIdBase Base question id of the signature list.\r
2466\r
2467 @retval EFI_SUCCESS Success to update the signature list page\r
2468 @retval EFI_OUT_OF_RESOURCES Unable to allocate required resources.\r
20333c6d 2469\r
ecc722ad 2470**/\r
2471EFI_STATUS\r
2472UpdateDeletePage (\r
2473 IN SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData,\r
2474 IN CHAR16 *VariableName,\r
2475 IN EFI_GUID *VendorGuid,\r
2476 IN UINT16 LabelNumber,\r
2477 IN EFI_FORM_ID FormId,\r
2478 IN EFI_QUESTION_ID QuestionIdBase\r
2479 )\r
2480{\r
2481 EFI_STATUS Status;\r
2482 UINT32 Index;\r
2483 UINTN CertCount;\r
2484 UINTN GuidIndex;\r
2485 VOID *StartOpCodeHandle;\r
2486 VOID *EndOpCodeHandle;\r
2487 EFI_IFR_GUID_LABEL *StartLabel;\r
20333c6d 2488 EFI_IFR_GUID_LABEL *EndLabel;\r
ecc722ad 2489 UINTN DataSize;\r
2490 UINT8 *Data;\r
2491 EFI_SIGNATURE_LIST *CertList;\r
2492 EFI_SIGNATURE_DATA *Cert;\r
2493 UINT32 ItemDataSize;\r
2494 CHAR16 *GuidStr;\r
2495 EFI_STRING_ID GuidID;\r
2496 EFI_STRING_ID Help;\r
2497\r
2498 Data = NULL;\r
2499 CertList = NULL;\r
2500 Cert = NULL;\r
2501 GuidStr = NULL;\r
2502 StartOpCodeHandle = NULL;\r
2503 EndOpCodeHandle = NULL;\r
20333c6d 2504\r
ecc722ad 2505 //\r
2506 // Initialize the container for dynamic opcodes.\r
2507 //\r
2508 StartOpCodeHandle = HiiAllocateOpCodeHandle ();\r
2509 if (StartOpCodeHandle == NULL) {\r
2510 Status = EFI_OUT_OF_RESOURCES;\r
20333c6d 2511 goto ON_EXIT;\r
ecc722ad 2512 }\r
2513\r
2514 EndOpCodeHandle = HiiAllocateOpCodeHandle ();\r
2515 if (EndOpCodeHandle == NULL) {\r
2516 Status = EFI_OUT_OF_RESOURCES;\r
20333c6d 2517 goto ON_EXIT;\r
ecc722ad 2518 }\r
2519\r
2520 //\r
2521 // Create Hii Extend Label OpCode.\r
2522 //\r
2523 StartLabel = (EFI_IFR_GUID_LABEL *) HiiCreateGuidOpCode (\r
2524 StartOpCodeHandle,\r
2525 &gEfiIfrTianoGuid,\r
2526 NULL,\r
2527 sizeof (EFI_IFR_GUID_LABEL)\r
2528 );\r
2529 StartLabel->ExtendOpCode = EFI_IFR_EXTEND_OP_LABEL;\r
2530 StartLabel->Number = LabelNumber;\r
2531\r
2532 EndLabel = (EFI_IFR_GUID_LABEL *) HiiCreateGuidOpCode (\r
2533 EndOpCodeHandle,\r
2534 &gEfiIfrTianoGuid,\r
2535 NULL,\r
2536 sizeof (EFI_IFR_GUID_LABEL)\r
2537 );\r
2538 EndLabel->ExtendOpCode = EFI_IFR_EXTEND_OP_LABEL;\r
2539 EndLabel->Number = LABEL_END;\r
2540\r
2541 //\r
2542 // Read Variable.\r
2543 //\r
2544 DataSize = 0;\r
20333c6d 2545 Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, Data);\r
ecc722ad 2546 if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {\r
2547 goto ON_EXIT;\r
2548 }\r
2549\r
2550 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
2551 if (Data == NULL) {\r
2552 Status = EFI_OUT_OF_RESOURCES;\r
2553 goto ON_EXIT;\r
2554 }\r
2555\r
2556 Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, Data);\r
2557 if (EFI_ERROR (Status)) {\r
2558 goto ON_EXIT;\r
2559 }\r
2560\r
2561 GuidStr = AllocateZeroPool (100);\r
2562 if (GuidStr == NULL) {\r
2563 Status = EFI_OUT_OF_RESOURCES;\r
2564 goto ON_EXIT;\r
2565 }\r
2566\r
2567 //\r
2568 // Enumerate all KEK pub data.\r
2569 //\r
2570 ItemDataSize = (UINT32) DataSize;\r
2571 CertList = (EFI_SIGNATURE_LIST *) Data;\r
2572 GuidIndex = 0;\r
2573\r
2574 while ((ItemDataSize > 0) && (ItemDataSize >= CertList->SignatureListSize)) {\r
2575\r
2576 if (CompareGuid (&CertList->SignatureType, &gEfiCertRsa2048Guid)) {\r
2577 Help = STRING_TOKEN (STR_CERT_TYPE_RSA2048_SHA256_GUID);\r
2578 } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r
2579 Help = STRING_TOKEN (STR_CERT_TYPE_PCKS7_GUID);\r
2580 } else if (CompareGuid (&CertList->SignatureType, &gEfiCertSha1Guid)) {\r
2581 Help = STRING_TOKEN (STR_CERT_TYPE_SHA1_GUID);\r
2582 } else if (CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid)) {\r
2583 Help = STRING_TOKEN (STR_CERT_TYPE_SHA256_GUID);\r
20333c6d
QL
2584 } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha256Guid)) {\r
2585 Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA256_GUID);\r
2586 } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha384Guid)) {\r
2587 Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA384_GUID);\r
2588 } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha512Guid)) {\r
2589 Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA512_GUID);\r
ecc722ad 2590 } else {\r
2591 //\r
2592 // The signature type is not supported in current implementation.\r
2593 //\r
b7d269ea 2594 ItemDataSize -= CertList->SignatureListSize;\r
2595 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
ecc722ad 2596 continue;\r
2597 }\r
2598\r
2599 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
2600 for (Index = 0; Index < CertCount; Index++) {\r
20333c6d
QL
2601 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList\r
2602 + sizeof (EFI_SIGNATURE_LIST)\r
2603 + CertList->SignatureHeaderSize\r
ecc722ad 2604 + Index * CertList->SignatureSize);\r
2605 //\r
20333c6d 2606 // Display GUID and help\r
ecc722ad 2607 //\r
2608 GuidToString (&Cert->SignatureOwner, GuidStr, 100);\r
2609 GuidID = HiiSetString (PrivateData->HiiHandle, 0, GuidStr, NULL);\r
2610 HiiCreateCheckBoxOpCode (\r
2611 StartOpCodeHandle,\r
2612 (EFI_QUESTION_ID) (QuestionIdBase + GuidIndex++),\r
20333c6d
QL
2613 0,\r
2614 0,\r
2615 GuidID,\r
ecc722ad 2616 Help,\r
2617 EFI_IFR_FLAG_CALLBACK,\r
2618 0,\r
2619 NULL\r
20333c6d 2620 );\r
ecc722ad 2621 }\r
2622\r
2623 ItemDataSize -= CertList->SignatureListSize;\r
2624 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
2625 }\r
2626\r
2627ON_EXIT:\r
2628 HiiUpdateForm (\r
2629 PrivateData->HiiHandle,\r
2630 &gSecureBootConfigFormSetGuid,\r
2631 FormId,\r
2632 StartOpCodeHandle,\r
2633 EndOpCodeHandle\r
2634 );\r
2635\r
2636 if (StartOpCodeHandle != NULL) {\r
2637 HiiFreeOpCodeHandle (StartOpCodeHandle);\r
2638 }\r
2639\r
2640 if (EndOpCodeHandle != NULL) {\r
2641 HiiFreeOpCodeHandle (EndOpCodeHandle);\r
2642 }\r
20333c6d 2643\r
ecc722ad 2644 if (Data != NULL) {\r
2645 FreePool (Data);\r
2646 }\r
2647\r
2648 if (GuidStr != NULL) {\r
2649 FreePool (GuidStr);\r
2650 }\r
2651\r
2652 return EFI_SUCCESS;\r
2653}\r
2654\r
beda2356 2655/**\r
20333c6d 2656 Delete a KEK entry from KEK database.\r
beda2356 2657\r
ecc722ad 2658 @param[in] PrivateData Module's private data.\r
2659 @param[in] QuestionId Question id of the KEK item to delete.\r
beda2356 2660\r
ecc722ad 2661 @retval EFI_SUCCESS Delete kek item successfully.\r
2662 @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.\r
20333c6d 2663\r
ecc722ad 2664**/\r
2665EFI_STATUS\r
2666DeleteKeyExchangeKey (\r
2667 IN SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData,\r
2668 IN EFI_QUESTION_ID QuestionId\r
2669 )\r
2670{\r
2671 EFI_STATUS Status;\r
2672 UINTN DataSize;\r
2673 UINT8 *Data;\r
2674 UINT8 *OldData;\r
2675 UINT32 Attr;\r
2676 UINT32 Index;\r
2677 EFI_SIGNATURE_LIST *CertList;\r
2678 EFI_SIGNATURE_LIST *NewCertList;\r
2679 EFI_SIGNATURE_DATA *Cert;\r
2680 UINTN CertCount;\r
2681 UINT32 Offset;\r
2682 BOOLEAN IsKEKItemFound;\r
2683 UINT32 KekDataSize;\r
2684 UINTN DeleteKekIndex;\r
2685 UINTN GuidIndex;\r
2686\r
2687 Data = NULL;\r
2688 OldData = NULL;\r
2689 CertList = NULL;\r
2690 Cert = NULL;\r
20333c6d 2691 Attr = 0;\r
ecc722ad 2692 DeleteKekIndex = QuestionId - OPTION_DEL_KEK_QUESTION_ID;\r
f71ed839 2693\r
2694 Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
2695 if (EFI_ERROR (Status)) {\r
2696 return Status;\r
2697 }\r
20333c6d 2698\r
ecc722ad 2699 //\r
2700 // Get original KEK variable.\r
20333c6d
QL
2701 //\r
2702 DataSize = 0;\r
ecc722ad 2703 Status = gRT->GetVariable (EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid, NULL, &DataSize, NULL);\r
2704 if (EFI_ERROR(Status) && Status != EFI_BUFFER_TOO_SMALL) {\r
2705 goto ON_EXIT;\r
2706 }\r
2707\r
2708 OldData = (UINT8*)AllocateZeroPool(DataSize);\r
2709 if (OldData == NULL) {\r
20333c6d 2710 Status = EFI_OUT_OF_RESOURCES;\r
ecc722ad 2711 goto ON_EXIT;\r
2712 }\r
2713\r
2714 Status = gRT->GetVariable (EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid, &Attr, &DataSize, OldData);\r
2715 if (EFI_ERROR(Status)) {\r
2716 goto ON_EXIT;\r
2717 }\r
2718\r
2719 //\r
20333c6d 2720 // Allocate space for new variable.\r
ecc722ad 2721 //\r
2722 Data = (UINT8*) AllocateZeroPool (DataSize);\r
2723 if (Data == NULL) {\r
2724 Status = EFI_OUT_OF_RESOURCES;\r
2725 goto ON_EXIT;\r
2726 }\r
2727\r
2728 //\r
2729 // Enumerate all KEK pub data and erasing the target item.\r
2730 //\r
2731 IsKEKItemFound = FALSE;\r
2732 KekDataSize = (UINT32) DataSize;\r
2733 CertList = (EFI_SIGNATURE_LIST *) OldData;\r
2734 Offset = 0;\r
2735 GuidIndex = 0;\r
2736 while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {\r
2737 if (CompareGuid (&CertList->SignatureType, &gEfiCertRsa2048Guid) ||\r
2738 CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r
2739 CopyMem (Data + Offset, CertList, (sizeof(EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize));\r
2740 NewCertList = (EFI_SIGNATURE_LIST *)(Data + Offset);\r
2741 Offset += (sizeof(EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
2742 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
2743 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
2744 for (Index = 0; Index < CertCount; Index++) {\r
2745 if (GuidIndex == DeleteKekIndex ) {\r
2746 //\r
2747 // Find it! Skip it!\r
2748 //\r
2749 NewCertList->SignatureListSize -= CertList->SignatureSize;\r
20333c6d 2750 IsKEKItemFound = TRUE;\r
ecc722ad 2751 } else {\r
2752 //\r
2753 // This item doesn't match. Copy it to the Data buffer.\r
2754 //\r
2755 CopyMem (Data + Offset, Cert, CertList->SignatureSize);\r
2756 Offset += CertList->SignatureSize;\r
2757 }\r
2758 GuidIndex++;\r
2759 Cert = (EFI_SIGNATURE_DATA *) ((UINT8*) Cert + CertList->SignatureSize);\r
2760 }\r
2761 } else {\r
2762 //\r
2763 // This List doesn't match. Copy it to the Data buffer.\r
2764 //\r
2765 CopyMem (Data + Offset, CertList, CertList->SignatureListSize);\r
2766 Offset += CertList->SignatureListSize;\r
2767 }\r
20333c6d 2768\r
ecc722ad 2769 KekDataSize -= CertList->SignatureListSize;\r
2770 CertList = (EFI_SIGNATURE_LIST*) ((UINT8*) CertList + CertList->SignatureListSize);\r
2771 }\r
2772\r
2773 if (!IsKEKItemFound) {\r
2774 //\r
2775 // Doesn't find the Kek Item!\r
2776 //\r
2777 Status = EFI_NOT_FOUND;\r
2778 goto ON_EXIT;\r
2779 }\r
2780\r
2781 //\r
2782 // Delete the Signature header if there is no signature in the list.\r
2783 //\r
2784 KekDataSize = Offset;\r
2785 CertList = (EFI_SIGNATURE_LIST*) Data;\r
2786 Offset = 0;\r
2787 ZeroMem (OldData, KekDataSize);\r
2788 while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {\r
2789 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
33985e3b 2790 DEBUG ((DEBUG_INFO, " CertCount = %x\n", CertCount));\r
ecc722ad 2791 if (CertCount != 0) {\r
2792 CopyMem (OldData + Offset, CertList, CertList->SignatureListSize);\r
2793 Offset += CertList->SignatureListSize;\r
20333c6d 2794 }\r
ecc722ad 2795 KekDataSize -= CertList->SignatureListSize;\r
2796 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
2797 }\r
2798\r
ecc722ad 2799 DataSize = Offset;\r
8c1babfd 2800 if ((Attr & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {\r
2801 Status = CreateTimeBasedPayload (&DataSize, &OldData);\r
2802 if (EFI_ERROR (Status)) {\r
2803 DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
2804 goto ON_EXIT;\r
2805 }\r
2806 }\r
ecc722ad 2807\r
2808 Status = gRT->SetVariable(\r
20333c6d
QL
2809 EFI_KEY_EXCHANGE_KEY_NAME,\r
2810 &gEfiGlobalVariableGuid,\r
2811 Attr,\r
2812 DataSize,\r
ecc722ad 2813 OldData\r
2814 );\r
2815 if (EFI_ERROR (Status)) {\r
2816 DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));\r
2817 goto ON_EXIT;\r
2818 }\r
20333c6d 2819\r